CVE-2025-30091 — Tiny / MoxieManager PHP

CVE-2025-30091

Tiny / MoxieManager PHP PUBLISHED

Description (CNA)

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.

Affected (CNA)

Vendor / product	Versions
Tiny / MoxieManager PHP	affected 0 before 4.0.0

CWE

CWE-96

References

https://www.moxiemanager.com/documentation/SEC-1063.php
https://www.moxiemanager.com/changelog/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.