CVE-2025-30091

9.4 criticalEPSS 0.8%

Critical (9.4). EPSS 0.8% chance of exploitation in the next 30 days.

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-96
Published: 2025-03-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.moxiemanager.com/changelog/
https://www.moxiemanager.com/documentation/SEC-1063.php

Check your stack JSON