CVE-2025-44998

CVE-2025-44998 요약 TinyFileManager v2.4.7의 /tinyfilemanager.php 구성 요소에 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 공격자는 js-theme-3 매개변수에 조작된 페이로드를 주입하여 임의의 JavaScript 또는 HTML을 실행할 수 있습니다. PoC 취약점을 확인하려면 설정 페이지url: http://localhost/index.php?p=&settings=1로 이동하세요. 요청을 보내는 동안 js-theme-3 매개변수 값을 다음 페이로드로 수정하세요:...

TinyFileManager Path Traversal Vulnerability

TinyFileManager is a web-based file manager. It is used to store, upload, edit and manage files and folders online through a web browser. TinyFileManager has a path traversal vulnerability that stems from the parameter fullpath in the file tinyfilemanager.php failing to correctly filter special...

TinyFileManager 路径遍历漏洞

TinyFileManager is a web-based file manager. It is used to store, upload, edit and manage files and folders online through a web browser. TinyFileManager has a path traversal vulnerability that stems from the parameter fullpath in the file tinyfilemanager.php failing to correctly filter special...

CVE-2025-15138: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and...

CVE-2025-44998: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecting a crafted payload into the js-theme-3 parameter...

CVE-2021-45010: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers with valid user accounts to upload malicious PHP files to the webroot, leading to code execution...

CVE-2021-40966: Improper Neutralization of Input During Web Page Generation

A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javascript in its name. A malicious user can upload a file with a malicious filename containing javascript code and it will run on any user...