Tiki vulnerabilities, page 2
92 vulnerabilities
Known vulnerabilities in Tiki products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
CVE-2007-6526tikitikiwiki_cms\/groupware
EPSS score1.56%
Cross-site scripting (XSS) vulnerability in tiki-special_chars.php in TikiWiki before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via the area_name parameter.CVE-2007-6528tikitikiwiki_cms\/groupwareEPSS score9.27%
Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) and modified filename in the movie parameter.CVE-2016-9889tikitikiwiki_cms\/groupwareEPSS score1.25%
Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.CVE-2016-7394tikitikiwiki_cms\/groupwareEPSS score0.64%
tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie.CVE-2016-10143tikitikiwiki_cms\/groupwareEPSS score1.85%
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.CVE-2025-32461tikitikiEPSS score0.92%
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.CVE-2025-34111tiki software community associationwiki cms groupware+1EPSS score2.57%
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.CVE-2020-16131tikitikiEPSS score0.69%
Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.CVE-2020-29254tikitikiwiki_cms\/groupwareEPSS score1.50%
TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These action include allowing attackers to submit their own code through an authenticated user resulting in local file Inclusion. If an authenticated user who is able to edit TikiWiki templates visits an malicious website, template code can be edited.CVE-2020-15906tikitikiEPSS score27.16%
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.CVE-2020-8966tiki-wiki groupwaretiki-wiki cms+1EPSS score0.87%
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.CVE-2005-1921debianegroupware+6EPSS score79.07%
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.CVE-2005-1925tikitikiwiki_cms\/groupwareEPSS score2.65%
Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands via (1) the suck_url parameter to tiki-editpage.php or (2) language parameter to tiki-user_preferences.php.CVE-2005-0200tikitikiwiki_cms\/groupwareEPSS score2.45%
TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386.CVE-2005-3529tikitikiwiki_cms\/groupwareEPSS score1.43%
tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to obtain the installation path via an invalid topics_sort_mode parameter, possibly related to an SQL injection vulnerability.CVE-2005-3283tikitikiwiki_cms\/groupwareEPSS score2.68%
Cross-site scripting (XSS) vulnerability in TikiWiki before 1.9.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.CVE-2005-3528tikitikiwiki_cms\/groupwareEPSS score1.26%
Cross-site scripting (XSS) vulnerability in tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arbitrary web script or HTML via the topics_offset parameter.CVE-2008-1047tikitikiwiki_cms\/groupwareEPSS score1.09%
Cross-site scripting (XSS) vulnerability in tiki-edit_article.php in TikiWiki before 1.9.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2008-5318tikitikiwiki_cms\/groupwareEPSS score1.27%
Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653.CVE-2008-5319tikitikiwiki_cms\/groupwareEPSS score1.27%
Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE-2008-3653.