CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30091
https://notcve.org/view.php?id=CVE-2025-30091
25 Mar 2025 — In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed. • https://www.moxiemanager.com/changelog • CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-10012
https://notcve.org/view.php?id=CVE-2019-10012
25 Mar 2019 — Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.NET\ICSFileServer. Jenzabar JICS (también se conoce como Internet Campus Solution) anterior a versión 9, permite que los atacantes remotos carguen y ejecuten código .aspx arbitrario colocándolo en un archivo ZIP y utilizando el plugi... • https://medium.com/%40mdavis332/critical-vulnerability-in-higher-ed-erp-55580f8880c • CWE-434: Unrestricted Upload of File with Dangerous Type •