CVSS: 6.1EPSS: %CPEs: 1EXPL: 0CVE-2025-23986 – Tiki Time <= 1.3 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2025-23986
18 Jan 2025 — The Tiki Time theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 1CVE-2023-22850
https://notcve.org/view.php?id=CVE-2023-22850
14 Jan 2023 — Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call. Tiki anterior a 24.1, cuando la función Spreadsheets está habilitada, permite la inyección de objetos PHP lib/sheet/grid.php debido a una llamada de deserialización. • https://karmainsecurity.com/KIS-2023-03 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 2CVE-2023-22851 – Tiki Wiki CMS Groupware 24.1 tikiimporter_blog_wordpress.php PHP Object Injection
https://notcve.org/view.php?id=CVE-2023-22851
10 Jan 2023 — Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call. Tiki anterior a 24.2 permite la inyección de objetos PHP lib/importer/tikiimporter_blog_wordpress.php por parte de un administrador debido a una llamada de deseriaización. Tiki Wiki CMS Groupware versions 24.1 and below suffer from a PHP object injection vulnerability in tikiimporter_blog_wordpress.php. • https://packetstorm.news/files/id/170435 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-22852 – Tiki Wiki CMS Groupware 25.0 Cross Site Request Forgery
https://notcve.org/view.php?id=CVE-2023-22852
10 Jan 2023 — Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php. Tiki hasta la versión 25.0 permite ataques CSRF relacionados con tiki-importer.php y tiki-import_sheet.php. Tiki Wiki CMS Groupware versions 25.0 and below suffer from multiple cross site request forgery vulnerabilities. • https://packetstorm.news/files/id/170432 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-22853 – Tiki Wiki CMS Groupware 24.0 structlib.php Code Execution
https://notcve.org/view.php?id=CVE-2023-22853
10 Jan 2023 — Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval. Tiki anterior a 24.1, cuando feature_create_webhelp está habilitado, permite la inyección de objetos PHP lib/structures/structlib.php debido a una evaluación. Tiki Wiki CMS Groupware versions 24.0 and below suffer from a PHP code injection vulnerability in structlib.php. • https://packetstorm.news/files/id/170433 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36551
https://notcve.org/view.php?id=CVE-2021-36551
28 Oct 2021 — TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module. Se ha detectado que TikiWiki versión v21.4 contiene una vulnerabilidad de tipo cross-site scripting (XSS) en el componente tiki-calendar.php. Esta vulnerabilidad permite a atacantes ejecutar scripts web o HTML arbitrarios por medio de una carga útil diseñada en el ... • https://github.com/r0ck3t1973/xss_payload/issues/7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36550
https://notcve.org/view.php?id=CVE-2021-36550
28 Oct 2021 — TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module. Se ha detectado que TikiWiki versión v21.4 contiene una vulnerabilidad de tipo cross-site scripting (XSS) en el componente tiki-browse_categories.php. Esta vulnerabilidad permite a atacantes ejecutar scripts web o HTML arbitrarios por medio de una ca... • https://github.com/r0ck3t1973/xss_payload/issues/6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 3CVE-2020-29254
https://notcve.org/view.php?id=CVE-2020-29254
11 Dec 2020 — TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the atta... • https://github.com/S1lkys/CVE-2020-29254 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 87%CPEs: 1EXPL: 3CVE-2020-15906 – Tiki Wiki CMS Groupware 21.1 Authentication Bypass
https://notcve.org/view.php?id=CVE-2020-15906
21 Oct 2020 — tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. El archivo tiki-login.php en Tiki versiones anteriores a 21.2, establece la contraseña de administrador en un valor en blanco después de 50 intentos de inicio de sesión no válidos Tiki Wiki CMS Groupware version 21.1 suffers from an authentication bypass vulnerability. • https://packetstorm.news/files/id/159663 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-16131
https://notcve.org/view.php?id=CVE-2020-16131
03 Aug 2020 — Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php. Tiki versiones anteriores a 21.2, permite un ataque de tipo XSS porque [\s\/"\'] no es considerado apropiadamente en la biblioteca lib/core/TikiFilter/PreventXss.php • https://gitlab.com/tikiwiki/tiki/-/commit/d12d6ea7b025d3b3f81c8a71063fe9f89e0c4bf1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •