CVSS: 7.5EPSS: 95%CPEs: 6EXPL: 6CVE-2005-1921 – PHP XML-RPC Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2005-1921
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement. • https://www.exploit-db.com/exploits/43829 https://www.exploit-db.com/exploits/16882 https://www.exploit-db.com/exploits/1078 https://www.exploit-db.com/exploits/1083 https://www.exploit-db.com/exploits/1084 http://marc.info/?l=bugtraq&m=112008638320145&w=2 http://marc.info/?l=bugtraq&m=112015336720867&w=2 http://marc.info/?l=bugtraq&m=112605112027335&w=2 http://pear.php.net/package/XML_RPC/download/1.3.1 http://secunia.com/advisories/15810 http: • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2005-0200
https://notcve.org/view.php?id=CVE-2005-0200
TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386. • http://secunia.com/advisories/13948 http://tikiwiki.org/art102 http://www.gentoo.org/security/en/glsa/glsa-200501-41.xml • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2004-1386
https://notcve.org/view.php?id=CVE-2004-1386
TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200. • http://securitytracker.com/id?1012700 http://tikiwiki.org/tiki-read_article.php?articleId=97 http://www.ciac.org/ciac/bulletins/p-084.shtml http://www.gentoo.org/security/en/glsa/glsa-200501-12.xml http://www.osvdb.org/12628 http://www.securityfocus.com/bid/12110 https://exchange.xforce.ibmcloud.com/vulnerabilities/18691 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 3%CPEs: 2EXPL: 3CVE-2004-1928 – TikiWiki Project 1.8 - 'img/wiki_up' Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2004-1928
The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wiki_up URL. • https://www.exploit-db.com/exploits/23948 https://www.exploit-db.com/exploits/43809 http://marc.info/?l=bugtraq&m=108180073206947&w=2 http://secunia.com/advisories/11344 http://tikiwiki.org/tiki-read_article.php?articleId=66 http://www.securityfocus.com/bid/10100 https://exchange.xforce.ibmcloud.com/vulnerabilities/15849 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 18CVE-2004-1925 – TikiWiki Project 1.8 - 'tiki-directory_ranking.php?sort_mode' SQL Injection
https://notcve.org/view.php?id=CVE-2004-1925
Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode parameter in (1) tiki-usermenu.php, (2) tiki-list_file_gallery.php, (3) tiki-directory_ranking.php, (4) tiki-browse_categories.php, (5) tiki-index.php, (6) tiki-user_tasks.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-file_galleries.php, (10) tiki-list_faqs.php, (11) tiki-list_trackers.php, (12) tiki-list_blogs.php, or via the offset parameter in (13) tiki-usermenu.php, (14) tiki-browse_categories.php, (15) tiki-index.php, (16) tiki-user_tasks.php, (17) tiki-list_faqs.php, (18) tiki-list_trackers.php, or (19) tiki-list_blogs.php. • https://www.exploit-db.com/exploits/23965 https://www.exploit-db.com/exploits/23984 https://www.exploit-db.com/exploits/23977 https://www.exploit-db.com/exploits/23982 https://www.exploit-db.com/exploits/23975 https://www.exploit-db.com/exploits/23964 https://www.exploit-db.com/exploits/23983 https://www.exploit-db.com/exploits/23976 https://www.exploit-db.com/exploits/23978 https://www.exploit-db.com/exploits/23963 https://www.exploit-db.com/exploits/23972 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •