What is CVE-2025-30091?

CVE-2025-30091 is a vulnerability in Tiny Moxiemanager PHP, classified under Improper Neutralization of Directives in Statically Saved Code (Static Code Injection). Published 2025-03-25.

Is CVE-2025-30091 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Tiny Moxiemanager PHP

CVE-2025-30091

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.

EPSS: 0.007 (51.8th percentile) — read the EPSS interpretation.

Affected products

Tiny Moxiemanager Php — versions 0

Weakness classification (CWE)

CWE-96 — Improper Neutralization of Directives in Statically Saved Code (Static Code Injection)

Public proof-of-concept exploits

pyguerder/CVE

References

Frequently asked questions

What is CVE-2025-30091?: CVE-2025-30091 is a vulnerability in Tiny Moxiemanager PHP, classified under Improper Neutralization of Directives in Statically Saved Code (Static Code Injection). Published 2025-03-25.
Is CVE-2025-30091 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.