CVE-2025-30091: In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated...
9.4
CVSS
Description
In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.
Classification
CVE ID: CVE-2025-30091
CVSS Base Severity: CRITICAL
CVSS Base Score: 9.4
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Problem Types
CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')Affected Products
Vendor: Tiny
Product: MoxieManager PHP
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.3% (probability of being exploited)
EPSS Percentile: 53.05% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-30091https://www.moxiemanager.com/documentation/SEC-1063.php
https://www.moxiemanager.com/changelog/