CVE-2022-45475

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application is vulnerable to broken access control.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	Tiny File Manager	2.4.8

References

https://fluidattacks.com/advisories/mosey/Exploit, Third Party Advisory
https://github.com/prasathmani/tinyfilemanager/Product
https://fluidattacks.com/advisories/mosey/Exploit, Third Party Advisory
https://github.com/prasathmani/tinyfilemanager/Product

Timeline

Published: Nov 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-454769.8Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download CVE-2022-454779.8Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization CVE-2022-454785.9Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses CVE-2022-454799.8PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorizat CVE-2022-45486.5The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its sett CVE-2022-454805.9PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data CVE-2022-454819.8The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no CVE-2022-454829.8Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily a CVE-2022-454835.9Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypres CVE-2022-454843.3A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcen CVE-2022-45494.3The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to mak CVE-2022-454917.8Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (Novembe