Read the docs
TI-2025-21442 Aliases CVE-2025-30091GHSA-fp8m-c995-8jh3

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer…

Priority MEDIUM 44CWE-96Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00787 56th percentileScored 2026-11-07
Fix Fixed MoxieManager PHP (Tiny): 4.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TinyMoxieManager PHPbefore 4.0.04.0.0Patch availableCNA
  • MoxieManager PHP VendorTiny Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA

Remediation

  • Fix · CNA MoxieManager PHP (Tiny) Fixed in 4.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-30091
  2. 2026-10-03 Alias added: GHSA-fp8m-c995-8jh3

References

Other 2

  • TI-2011-04222 TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. CVSS 3.1CRITICAL 9.8
  • TI-2011-04220 Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. CVSS 3.1CRITICAL 9.8
  • TI-2021-06163 Arbitrary file upload in plupload CVSS 3.1HIGH 8.8
  • TI-2026-35259 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVSS 3.1HIGH 8.7
  • TI-2026-35258 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVSS 3.1HIGH 8.7
  • TI-2026-35256 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVSS 3.1HIGH 8.7
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences