CVE-2025-44998

CVE-2025-44998 摘要 在 TinyFileManager v2.4.7 的 /tinyfilemanager.php 组件中存在一个存储型跨站脚本（XSS）漏洞，攻击者可通过向 js-theme-3 参数注入特制有效载荷来执行任意 JavaScript 或 HTML。 PoC 要检查漏洞，请进入设置页面（网址：http://localhost/index.php?p=&settings=1）。 发送请求时，将 js-theme-3 参数的值修改为以下有效载荷：light“nav+a=” 注入的脚本随后将执行，并可在整个页面（包括登录界面）中运行。 影响 用作会话 ID 的...

TinyFileManager Path Traversal Vulnerability

TinyFileManager is a web-based file manager. It is used to store, upload, edit and manage files and folders online through a web browser. TinyFileManager has a path traversal vulnerability that stems from the parameter fullpath in the file tinyfilemanager.php failing to correctly filter special...

TinyFileManager 路径遍历漏洞

TinyFileManager is a web-based file manager. It is used to store, upload, edit and manage files and folders online through a web browser. TinyFileManager has a path traversal vulnerability that stems from the parameter fullpath in the file tinyfilemanager.php failing to correctly filter special...