https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-46651.htmlhttps://patchthecve.com/cve/CVE-2025-46651.htmlWed, 17 Jun 2026 09:26:46 +0000MEDIUM 4.3: Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient validation of user-supplied URLs, an attacker can send crafted requests to localhost by using http://www.127.0.0.1.example.com/ or a similarly constructed domain nhttps://patchthecve.com/cve/CVE-2025-15138.htmlhttps://patchthecve.com/cve/CVE-2025-15138.htmlWed, 07 Oct 2026 12:10:00 +0000MEDIUM 4.7: A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and mahttps://patchthecve.com/cve/CVE-2025-44998.htmlhttps://patchthecve.com/cve/CVE-2025-44998.htmlWed, 17 Jun 2026 09:25:19 +0000MEDIUM 6.1: A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecting a crafted payload into the js-theme-3 parameter.https://patchthecve.com/cve/CVE-2022-40916.htmlhttps://patchthecve.com/cve/CVE-2022-40916.htmlWed, 17 Jun 2026 05:02:13 +0000CRITICAL 9.8: Tiny File Manager v2.4.7 and below is vulnerable to session fixation.https://patchthecve.com/cve/CVE-2022-40490.htmlhttps://patchthecve.com/cve/CVE-2022-40490.htmlWed, 17 Jun 2026 05:01:27 +0000MEDIUM 4.8: Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the name of an uploaded or already existing file.