Reflected XSS Vulnerability in tinyfilemanager.php

[hackersatyamrastogi]

Summary

A reflected cross-site scripting (XSS) vulnerability exists in TinyFileManager.
User-supplied GET parameters (view and edit) are not properly sanitized when rendered in the HTML <title> tag.

Affected Component

• File: tinyfilemanager.php
• Line: 3990

php

<title> | </title>

Proof of Concept (PoC)
GET /tinyfilemanager.php?view="><script>alert('XSS')</script>