CVE-2006-6163

Published: Nov 29, 2006Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in tiki-setup_base.php in TikiWiki before 1.9.7 allows remote attackers to inject arbitrary JavaScript via unspecified parameters.

Affected (11)

Products: Tiki: Tikiwiki Cms/groupware

Tiki

1 product

Tikiwiki Cms/groupware

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Tiki Tikiwiki Cms/groupware	version ≤ 1.9.6
Tiki Tikiwiki Cms/groupware	Version 1.6.1
Tiki Tikiwiki Cms/groupware	Version 1.9.0
Tiki Tikiwiki Cms/groupware	Version 1.9.0 rc1
Tiki Tikiwiki Cms/groupware	Version 1.9.0 rc2
Tiki Tikiwiki Cms/groupware	Version 1.9.0 rc3
Tiki Tikiwiki Cms/groupware	Version 1.9.1
Tiki Tikiwiki Cms/groupware	Version 1.9.2
Tiki Tikiwiki Cms/groupware	Version 1.9.3
Tiki Tikiwiki Cms/groupware	Version 1.9.4
Tiki Tikiwiki Cms/groupware	Version 1.9.5

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/4709

Source: cve@mitre.org

http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2006/4709

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.