TF
Product
Tiny File Manager
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 6Low 0
Watch
Add Tiny File Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-40916 | 9.8 | Feb 6 | Tiny File Manager v2.4.7 and below is vulnerable to session fixation Affected: through 2.4.7 |
| CVE-2022-45476 | 9.8 | Nov 25 | Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download Affected: 2.4.8 |
| CVE-2022-1000 | 9.8 | Mar 17 | Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7 Affected: before 2.4.7 |
| CVE-2022-23044 | 8.8 | Nov 25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application Affected: 2.4.8 |
| CVE-2021-45010 | 8.8 | Mar 15 | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to… Affected: through 2.4.7 |
| CVE-2021-40965 | 8.8 | Sep 15 | A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by… Affected: through 2.4.6 |
| CVE-2019-16790 | 8.8 | Dec 30 | In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files Affected: before 2.3.9 |
| CVE-2020-12103 | 7.7 | Apr 28 | In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak… Affected: 2.4.1 |
| CVE-2020-12102 | 7.7 | Apr 28 | In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality Affected: 2.4.1 |
| CVE-2025-15138 | 7.2 | Dec 28 | prasathmani TinyFileManager tinyfilemanager.php path traversal Affected: through 2.6 |
| CVE-2022-45475 | 6.5 | Nov 25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files Affected: 2.4.8 |
| CVE-2021-40964 | 6.5 | Sep 15 | A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF… Affected: through 2.4.6 |
| CVE-2025-44998 | 6.1 | May 23 | A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via… Affected: 2.4.7 |
| CVE-2021-40966 | 5.4 | Sep 15 | A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javascript in its name Affected: through 2.4.6 |
| CVE-2022-40490 | 4.8 | Feb 6 | Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability Affected: through 2.4.7 |
| CVE-2025-46651 | 4.3 | Feb 3 | Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature Affected: through 2.6 |
Showing 16