CVE-2019-25709

CF Image Hosting Script version 1.6.5 and prior contains a critical information disclosure and integrity vulnerability affecting the application's database security. An unauthenticated attacker can directly access and download the imgdb.db file from the publicly accessible upload/data directory, exposing the entire application database in plaintext format. The vulnerability carries a CVSS score of 9.8 CRITICAL with network-based attack vector, low complexity, and no authentication required. Successful exploitation grants attackers complete read access to sensitive database contents and write/delete capabilities, enabling them to extract delete IDs and systematically remove all stored images by manipulating the d parameter. The vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows minimal community attention with an EPSS score of 0.000760, indicating low prevalence in active attack campaigns. However, the straightforward exploitation method and severe impact present significant risk for organizations still running vulnerable versions, requiring immediate patching regardless of current threat intelligence indicators.