Prasathmani Tiny_file_manager
16 CVEs affecting Prasathmani Tiny_file_manager. Latest disclosed: 2026-02-03. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40916 | Critical | 9.8 | 2025-02-06 | Tiny File Manager v2.4.7 and below is vulnerable to session fixation. |
CVE-2022-45476 | Critical | 9.8 | 2022-11-25 | Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible… |
CVE-2022-1000 | Critical | 9.8 | 2022-03-17 | Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7. |
CVE-2022-23044 | High | 8.8 | 2022-11-25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possi… |
CVE-2021-45010 | High | 8.8 | 2022-03-15 | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid us… |
CVE-2021-40965 | High | 8.8 | 2021-09-15 | A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run… |
CVE-2020-12103 | High | 7.7 | 2020-04-28 | In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of file… |
CVE-2020-12102 | High | 7.7 | 2020-04-28 | In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to e… |
CVE-2022-45475 | Medium | 6.5 | 2022-11-25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application… |
CVE-2021-40964 | Medium | 6.5 | 2021-09-15 | A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials o… |
CVE-2019-16790 | Medium | 6.5 | 2019-12-30 | In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted. |
CVE-2025-44998 | Medium | 6.1 | 2025-05-23 | A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScr… |
CVE-2021-40966 | Medium | 5.4 | 2021-09-15 | A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and jav… |
CVE-2022-40490 | Medium | 4.8 | 2025-02-06 | Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerability allows attackers to execute arbitra… |
CVE-2025-15138 | Medium | 4.7 | 2025-12-28 | A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This mani… |
CVE-2025-46651 | Medium | 4.3 | 2026-02-03 | Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient validation of user-sup… |