CVE-2022-45476

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Nov 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-454779.8Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization CVE-2022-454785.9Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypressesCVE-2022-454799.8PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorizatCVE-2022-45486.5The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settCVE-2022-454805.9PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data CVE-2022-454819.8The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with noCVE-2022-454829.8Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily aCVE-2022-454835.9Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresCVE-2022-454843.3A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenCVE-2022-45494.3The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to makCVE-2022-454917.8Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (NovembeCVE-2022-454927.8Buffer overflow vulnerability in function json_parse_number in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (Novemb
CVE-2022-45476: Critical severity, CVSS 9.8 | Vulnix