CVE-2007-5683

Published: Oct 26, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to the password reminder page (tiki-remind_password.php), (2) IMG tags in wiki pages, and (3) the local_php parameter to db/tiki-db.php.

Affected (14)

Products: Tiki: Tikiwiki Cms/groupware

Tiki

1 product

Tikiwiki Cms/groupware

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Tiki Tikiwiki Cms/groupware	Up to 1.9.8.1
Tiki Tikiwiki Cms/groupware	Version 1.6.1
Tiki Tikiwiki Cms/groupware	Version 1.9.0
Tiki Tikiwiki Cms/groupware	Version 1.9.0 rc1
Tiki Tikiwiki Cms/groupware	Version 1.9.0 rc2
Tiki Tikiwiki Cms/groupware	Version 1.9.0 rc3
Tiki Tikiwiki Cms/groupware	Version 1.9.1
Tiki Tikiwiki Cms/groupware	Version 1.9.2
Tiki Tikiwiki Cms/groupware	Version 1.9.3
Tiki Tikiwiki Cms/groupware	Version 1.9.4
Tiki Tikiwiki Cms/groupware	Version 1.9.5
Tiki Tikiwiki Cms/groupware	Version 1.9.6
Tiki Tikiwiki Cms/groupware	Version 1.9.7
Tiki Tikiwiki Cms/groupware	Version 1.9.8

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://info.tikiwiki.org/tiki-read_article.php?articleId=15

Source: cve@mitre.org

Patch

http://www.securityfocus.com/archive/1/482801/30/0/threaded

Source: cve@mitre.org

http://info.tikiwiki.org/tiki-read_article.php?articleId=15

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/archive/1/482801/30/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.