Tikiwiki Cms/groupware

tikiwiki_cms/groupware

Vendor: Tiki • 74 CVEs

CVEs (74)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-9145 1Tiki 1Tikiwiki Cms/groupware May 13, 2026 Jun 26, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.
CVE-2017-9305 1Tiki 1Tikiwiki Cms/groupware May 13, 2026 May 31, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
CVE-2016-10143 1Tiki 1Tikiwiki Cms/groupware May 13, 2026 Jan 20, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.
CVE-2016-9889 1Tiki 1Tikiwiki Cms/groupware May 6, 2026 Dec 23, 2016 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image...Show more Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.Show less
CVE-2013-4715 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Nov 6, 2013 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2013-4714 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Nov 6, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via uns...Show more Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2012-5321 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Oct 8, 2012 N/A· v4 N/A· v3 5.8 MEDIUM· v2 tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection."
CVE-2011-4551 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Oct 1, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters.
CVE-2012-3996 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Jul 12, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.
CVE-2012-0911 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Jul 12, 2012 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printst...Show more TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.Show less
CVE-2010-1136 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Mar 27, 2010 N/A· v4 N/A· v3 7.5 HIGH· v2 The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on th...Show more The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php.Show less
CVE-2010-1135 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Mar 27, 2010 N/A· v4 N/A· v3 7.5 HIGH· v2 The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse.
CVE-2010-1134 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Mar 27, 2010 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL commands via the $searchDate variable.
CVE-2010-1133 1Tiki 1Tikiwiki Cms/groupware Apr 29, 2026 Mar 27, 2010 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) tiki-searchindex.php and (2) tiki-...Show more Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) tiki-searchindex.php and (2) tiki-searchresults.php.Show less
CVE-2003-1574 1Tiki 1Tikiwiki Cms/groupware Apr 23, 2026 Aug 24, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me" feature. NOTE: some of these details are o...Show more TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me" feature. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-1204 1Tiki 1Tikiwiki Cms/groupware Apr 23, 2026 Apr 1, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file...Show more Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file_gallery.php, (3) tiki-listpages.php, and (4) tiki-orphan_pages.php.Show less
CVE-2008-5319 1Tiki 1Tikiwiki Cms/groupware Apr 23, 2026 Dec 3, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE-2008-3653.
CVE-2008-5318 1Tiki 1Tikiwiki Cms/groupware Apr 23, 2026 Dec 3, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653.
CVE-2008-3654 1Tiki 1Tikiwiki Cms/groupware Apr 23, 2026 Aug 13, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors.
CVE-2008-3653 1Tiki 1Tikiwiki Cms/groupware Apr 23, 2026 Aug 13, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors.

Previous 123 4 Next