Paper/Archive/CVE-2025-30091

CVE-2025-30091

Tiny MoxieManager PHP — In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command.

EPSS 0.8%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 56.2.562 × 2011.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.

Affected

ProductAffectedFixed inSource

MoxieManager PHP< 4.0.04.0.0CNA

Scores by source

mitre (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refmoxiemanager.com/documentation/SEC-1063.php refmoxiemanager.com/changelog