Tikiwiki Cms\/Groupware vulnerabilities
74 vulnerabilities
Known vulnerabilities in Tikiwiki Cms\/Groupware, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-20719tikitikiwiki_cms\/groupware
EPSS score1.00%
In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.CVE-2018-14849tikitikiwiki_cms\/groupwareEPSS score0.68%
Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.CVE-2018-14850tikitikiwiki_cms\/groupwareEPSS score0.68%
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.CVE-2018-7290tikitikiwiki_cms\/groupwareEPSS score0.50%
Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1.CVE-2018-7188tikitikiwiki_cms\/groupwareEPSS score0.52%
An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php.CVE-2018-7303tikitikiwiki_cms\/groupwareEPSS score0.54%
The Calendar component in Tiki 17.1 allows HTML injection.CVE-2003-1574tikitikiwiki_cms\/groupwareEPSS score1.55%
TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me" feature. NOTE: some of these details are obtained from third party information.CVE-2013-4715tikitikiwiki_cms\/groupwareEPSS score1.87%
SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2013-4714tikitikiwiki_cms\/groupwareEPSS score1.16%
Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2013-6022tikitiki+1EPSS score1.35%
A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code.CVE-2021-36550tikitikiwiki_cms\/groupwareEPSS score0.50%
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module.CVE-2021-36551tikitikiwiki_cms\/groupwareEPSS score0.50%
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module.CVE-2007-4554tikitikiwiki_cms\/groupwareEPSS score1.74%
Cross-site scripting (XSS) vulnerability in tiki-remind_password.php in Tikiwiki (aka Tiki CMS/Groupware) 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: this issue might be related to CVE-2006-2635.7.CVE-2007-5684tikitikiwiki_cms\/groupwareEPSS score3.02%
Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in (1) error_handler_file and (2) local_php parameters to (a) tiki-index.php, or (3) encoded "..%2F" sequences in the imp_language parameter to tiki-imexport_languages.php.CVE-2007-5423tikitikiwiki_cms\/groupwareEPSS score76.66%
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.CVE-2007-5683tikitikiwiki_cms\/groupwareEPSS score0.89%
Multiple cross-site scripting (XSS) vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to the password reminder page (tiki-remind_password.php), (2) IMG tags in wiki pages, and (3) the local_php parameter to db/tiki-db.php.CVE-2007-5682tikitikiwiki_cms\/groupwareEPSS score2.58%
Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable functions and variable variables to write variables whose names match the whitelist, a different vulnerability than CVE-2007-5423.CVE-2007-6529tikitikiwiki_cms\/groupwareEPSS score1.87%
Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) tiki-list_games.php, or (3) tiki-g-admin_shared_source.php.CVE-2007-6526tikitikiwiki_cms\/groupwareEPSS score1.56%
Cross-site scripting (XSS) vulnerability in tiki-special_chars.php in TikiWiki before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via the area_name parameter.CVE-2007-6528tikitikiwiki_cms\/groupwareEPSS score9.27%
Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) and modified filename in the movie parameter.