CVSS: 5.0EPSS: 1%CPEs: 3EXPL: 1CVE-2005-3529
https://notcve.org/view.php?id=CVE-2005-3529
tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to obtain the installation path via an invalid topics_sort_mode parameter, possibly related to an SQL injection vulnerability. TikiWiki versions 1.9.x up to and including 1.9.2 suffer from a cross site scripting vulnerability and possible SQL injection vulnerabilities. • http://moritz-naumann.com/adv/0003/tikiw/0003.txt http://secunia.com/advisories/17521 http://securityreason.com/securityalert/165 http://www.osvdb.org/20711 http://www.securityfocus.com/archive/1/416152/30/0/threaded http://www.vupen.com/english/advisories/2005/2376 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2005-3283
https://notcve.org/view.php?id=CVE-2005-3283
Cross-site scripting (XSS) vulnerability in TikiWiki before 1.9.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. • http://bugs.gentoo.org/show_bug.cgi?id=109858 http://secunia.com/advisories/17279 http://secunia.com/advisories/17363 http://securitytracker.com/id?1015087 http://sourceforge.net/project/shownotes.php?release_id=364457 http://tikiwiki.org/art118 http://www.gentoo.org/security/en/glsa/glsa-200510-23.xml http://www.securityfocus.com/bid/15164 http://www.vupen.com/english/advisories/2005/2176 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 95%CPEs: 6EXPL: 6CVE-2005-1921 – PHP XML-RPC Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2005-1921
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement. • https://www.exploit-db.com/exploits/43829 https://www.exploit-db.com/exploits/16882 https://www.exploit-db.com/exploits/1078 https://www.exploit-db.com/exploits/1083 https://www.exploit-db.com/exploits/1084 http://marc.info/?l=bugtraq&m=112008638320145&w=2 http://marc.info/?l=bugtraq&m=112015336720867&w=2 http://marc.info/?l=bugtraq&m=112605112027335&w=2 http://pear.php.net/package/XML_RPC/download/1.3.1 http://secunia.com/advisories/15810 http: • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2005-0200
https://notcve.org/view.php?id=CVE-2005-0200
TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386. • http://secunia.com/advisories/13948 http://tikiwiki.org/art102 http://www.gentoo.org/security/en/glsa/glsa-200501-41.xml • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2004-1386
https://notcve.org/view.php?id=CVE-2004-1386
TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200. • http://securitytracker.com/id?1012700 http://tikiwiki.org/tiki-read_article.php?articleId=97 http://www.ciac.org/ciac/bulletins/p-084.shtml http://www.gentoo.org/security/en/glsa/glsa-200501-12.xml http://www.osvdb.org/12628 http://www.securityfocus.com/bid/12110 https://exchange.xforce.ibmcloud.com/vulnerabilities/18691 • CWE-20: Improper Input Validation •