CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 2CVE-2005-3528
https://notcve.org/view.php?id=CVE-2005-3528
20 Nov 2005 — Cross-site scripting (XSS) vulnerability in tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arbitrary web script or HTML via the topics_offset parameter. • http://moritz-naumann.com/adv/0003/tikiw/0003.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2005-3529
https://notcve.org/view.php?id=CVE-2005-3529
20 Nov 2005 — tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to obtain the installation path via an invalid topics_sort_mode parameter, possibly related to an SQL injection vulnerability. • http://moritz-naumann.com/adv/0003/tikiw/0003.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2005-1925
https://notcve.org/view.php?id=CVE-2005-1925
18 Nov 2005 — Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands via (1) the suck_url parameter to tiki-editpage.php or (2) language parameter to tiki-user_preferences.php. • http://securitytracker.com/id?1015190 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2005-3283
https://notcve.org/view.php?id=CVE-2005-3283
23 Oct 2005 — Cross-site scripting (XSS) vulnerability in TikiWiki before 1.9.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. • http://bugs.gentoo.org/show_bug.cgi?id=109858 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 86%CPEs: 6EXPL: 5CVE-2005-1921 – PHPXMLRPC < 1.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2005-1921
01 Jul 2005 — Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement. • https://www.exploit-db.com/exploits/43829 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2005-0200
https://notcve.org/view.php?id=CVE-2005-0200
06 Feb 2005 — TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386. • http://secunia.com/advisories/13948 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2004-1386
https://notcve.org/view.php?id=CVE-2004-1386
31 Dec 2004 — TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200. • http://securitytracker.com/id?1012700 • CWE-20: Improper Input Validation •
CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 18CVE-2004-1925 – TikiWiki Project 1.8 - 'tiki-directory_ranking.php?sort_mode' SQL Injection
https://notcve.org/view.php?id=CVE-2004-1925
12 Apr 2004 — Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode parameter in (1) tiki-usermenu.php, (2) tiki-list_file_gallery.php, (3) tiki-directory_ranking.php, (4) tiki-browse_categories.php, (5) tiki-index.php, (6) tiki-user_tasks.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-file_galleries.php, (10) tiki-list_faqs.php, (11) tiki-list_trackers.php, (12) tiki-list_blogs.php... • https://www.exploit-db.com/exploits/23965 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 7%CPEs: 2EXPL: 3CVE-2004-1928 – TikiWiki Project 1.8 - 'img/wiki_up' Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2004-1928
12 Apr 2004 — The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wiki_up URL. • https://www.exploit-db.com/exploits/23948 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 7%CPEs: 2EXPL: 3CVE-2004-1923 – TikiWiki Project 1.8 - 'categorize.php' Direct Request Full Path Disclosure
https://notcve.org/view.php?id=CVE-2004-1923
11 Apr 2004 — Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to gain sensitive information via a direct request to (1) banner_click.php, (2) categorize.php, (3) tiki-admin_include_directory.php, (4) tiki-directory_search.php, which reveal the web server path in an error message. • https://www.exploit-db.com/exploits/23952 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •