CVSS: 7.5EPSS: 1%CPEs: 14EXPL: 1CVE-2007-5684 – TikiWiki 1.9.8.1 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2007-5684
Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in (1) error_handler_file and (2) local_php parameters to (a) tiki-index.php, or (3) encoded "..%2F" sequences in the imp_language parameter to tiki-imexport_languages.php. Múltiples vulnerabilidades de escalado de directorio en el TikiWiki 1.9.8.1 y versiones anteriores permiten a atacantes remotos incluir y ejecutar ficheros de su elección a través de un nombre de ruta absoluta en los parámetros (1) error_handler_file y (2) local_php en el a) tiki-index.php, o en las secuencias (3) codificadas "..%2F" en el parámetro imp_language del tiki-imexport_languages.php. • https://www.exploit-db.com/exploits/4568 http://info.tikiwiki.org/tiki-read_article.php?articleId=15 http://www.securityfocus.com/archive/1/482801/30/0/threaded • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 0CVE-2006-6168
https://notcve.org/view.php?id=CVE-2006-6168
tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separated list of addresses in the email field, related to lack of "a minimal check on email." tiki-register.php en TikiWiki anterior a 1.9.7 permite a atacantes remotos disparar "notificación de spam" mediante vectores no especificados como una lista de direcciones separadas por coma en el campo email, relacionado con la falta de "un mínimo chequeo en email". • http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51 http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/tiki-register.php?r1=1.68&r2=1.69 http://www.vupen.com/english/advisories/2006/4709 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2006-6163
https://notcve.org/view.php?id=CVE-2006-6163
Cross-site scripting (XSS) vulnerability in tiki-setup_base.php in TikiWiki before 1.9.7 allows remote attackers to inject arbitrary JavaScript via unspecified parameters. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en tiki-setup_base.php en TikiWiki anterior a 1.9.7 permite a atacantes remotos inyectar código JavaScript de su elección mediante parámetros no especificados. • http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51 http://www.vupen.com/english/advisories/2006/4709 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 1CVE-2006-3047
https://notcve.org/view.php?id=CVE-2006-3047
Cross-site scripting (XSS) vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en TikiWiki v1.9.3.2 y versiones anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores de ataque desconocidos • http://secunia.com/advisories/20648 http://secunia.com/advisories/20850 http://securityreason.com/securityalert/1102 http://sourceforge.net/project/shownotes.php?group_id=64258&release_id=423840 http://www.gentoo.org/security/en/glsa/glsa-200606-29.xml http://www.securityfocus.com/archive/1/437017/100/0/threaded http://www.securityfocus.com/bid/18421 http://www.vupen.com/english/advisories/2006/2349 https://exchange.xforce.ibmcloud.com/vulnerabilities/27145 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2006-3048
https://notcve.org/view.php?id=CVE-2006-3048
SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. Vulnerabilidad de inyección SQL en TikiWiki v1.9.3.2 y posiblemente en versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores de ataque desconocidos. • http://secunia.com/advisories/20648 http://secunia.com/advisories/20850 http://securityreason.com/securityalert/1102 http://www.gentoo.org/security/en/glsa/glsa-200606-29.xml http://www.securityfocus.com/archive/1/437017/100/0/threaded http://www.securityfocus.com/bid/18421 http://www.vupen.com/english/advisories/2006/2349 https://exchange.xforce.ibmcloud.com/vulnerabilities/27146 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •