CVE-2025-30091

CVSS 9.4 CRITICALEPSS 0.7%CWE-96

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Produtos afetados

Tiny · MoxieManager PHP

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://www.moxiemanager.com/changelog/https://www.moxiemanager.com/documentation/SEC-1063.php