CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9305
https://notcve.org/view.php?id=CVE-2017-9305
31 May 2017 — lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php. lib/core /TikiFilter/PreventXss.php en Tiki Wiki CMS Groupware 16.2 permitiría a un atacante remoto pasar por alto el filtro XSS a través de caracteres de relleno cero, como lo demuestra un ataque a tiki-batch_send_newsletter.php. • https://github.com/tikiorg/tiki/commit/6c016e8f066d2f404b18eaa1af7fa0c7a9651ccd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10143 – Tiki Wiki CMS 15.2 Arbitrary File Read
https://notcve.org/view.php?id=CVE-2016-10143
20 Jan 2017 — A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field. Una vulnerabilidad en Tiki Wiki CMS 15.2 podría permitir a un atacante remoto leer archivos arbitrarios en un sistema objetivo a través de un nombre de ruta manipulado en un campo URL banner. Tiki Wiki CMS version 15.2 suffers from an arbitrary file read vulnerability. • http://www.securityfocus.com/bid/96787 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2016-9889
https://notcve.org/view.php?id=CVE-2016-9889
23 Dec 2016 — Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS. Algunas formas con el parámetro geo_zoomlevel_to_found_location en Tiki Wiki CMS 12.x en versiones anteriores a 12.10 LTS, 15.x en versiones anteriores a 15.3 LTS y 16.x en versiones anteriores a 16.1 no tienen la entrada desinfectada, relacionada con tiki-setup.php ... • http://www.securityfocus.com/bid/95083 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 24EXPL: 0CVE-2013-4714
https://notcve.org/view.php?id=CVE-2013-4714
06 Nov 2013 — Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-site scripting (XSS) en Tiki Wiki CMS Groupware 6 LTS antes 6.13LTS, 9 LTS antes 9.7LTS, 10.x antes de 10.4, 11.x anterior a 11.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados . • http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 24EXPL: 0CVE-2013-4715
https://notcve.org/view.php?id=CVE-2013-4715
06 Nov 2013 — SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en Tiki Wiki CMS Groupware 6 LTS anterior a 6.13LTS, 9 LTS anterior 9.7LTS, 10.x anterior a 10.4, 11.x anterior a 11.1 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 10%CPEs: 1EXPL: 5CVE-2012-5321 – Tiki Wiki CMS Groupware - 'url' Open Redirection
https://notcve.org/view.php?id=CVE-2012-5321
08 Oct 2012 — tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection." tiki-featured_link.php en TikiWiki CMS/Groupware 8.3, permite a atacantes remotos para cargar arbitrarias páginas del sitio web en marcos y llevar a cabo ataques de phishing a través del parámetro url, también conocido como "inyección de marco". • https://www.exploit-db.com/exploits/36848 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 3%CPEs: 24EXPL: 1CVE-2011-4551 – Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection
https://notcve.org/view.php?id=CVE-2011-4551
01 Oct 2012 — Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en tiki-cookie-jar.php en TikiWiki CMS/Groupware, antes de v8.2 y LTS antes de v6.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros de su elección. • https://www.exploit-db.com/exploits/36470 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 77%CPEs: 2EXPL: 5CVE-2012-0911 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-0911
12 Jul 2012 — TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function. TikiWiki CMS/Groupware anterior a v6.7 LTS... • https://www.exploit-db.com/exploits/19573 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 17%CPEs: 24EXPL: 5CVE-2012-3996 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-3996
12 Jul 2012 — TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php. TikiWiki CMS/Groupware v8.3 y anteriores permite a atacantes remotos obtener la ruta de instalación mediante una peticion a (1) admin/include_calendar.php, (2) tiki-rss_error.php, o (3) tiki-watershed_service.php. • https://www.exploit-db.com/exploits/19573 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2010-1133
https://notcve.org/view.php?id=CVE-2010-1133
26 Mar 2010 — Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) tiki-searchindex.php and (2) tiki-searchresults.php. Multiples vulnerabilidades de inyección SQL en TikiWiki CMS/Groupware v4.x anteriores a v4.2, permite a atacantes remotos ejecutar comandos SQL de su elección a través vectores no especificados, probablemente relativo a (1) tiki-searchindex.php y (2) tiki-searchresults.php... • http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •