critical9.4
CVE-2025-30091
In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command.
Impact
In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.
Affected products
| Product | Affected versions |
|---|---|
| Tiny MoxieManager PHP | before 4.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.