CVE-2025-44998: XSS

Published May 23, 2025

Updated

A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecting a crafted payload into the js-theme-3 parameter.

Affected Software

2 affected components

TinyFileManager TinyFileManager

prasathmani Tiny File Manager=2.4.7

Event History

May 23, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-44998?

CVE-2025-44998 is classified as a high severity vulnerability due to its potential for stored cross-site scripting attacks.

How do I fix CVE-2025-44998?

To fix CVE-2025-44998, you should upgrade to the latest version of TinyFileManager released after v2.4.7.

What is the impact of CVE-2025-44998?

The impact of CVE-2025-44998 allows attackers to execute arbitrary JavaScript or HTML code on users' browsers.

Who is affected by CVE-2025-44998?

CVE-2025-44998 affects all users of TinyFileManager v2.4.7 that utilize the /tinyfilemanager.php component.

Is CVE-2025-44998 easily exploitable?

Yes, CVE-2025-44998 can be easily exploited by injecting crafted payloads through the js-theme-3 parameter.