EXECUTIVE SUMMARY:
Tiny Technologies has issued a security advisory about a critical remote code execution vulnerability in MoxieManager, a file and media management solution for PHP and .NET environments. Identified as CVE-2025-30091 with a CVSSv4 score of 9.4, the flaw allows unauthenticated attackers to inject and execute arbitrary code via the PHP installer command. MoxieManager is widely used in CMS, web hosting controllers, and LMS, making this vulnerability a significant risk. To mitigate the threat, Users are strongly urged to update immediately, with a temporary workaround available by manually deleting the install directory after installation.
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details: