TC
Product
Tikiwiki Cms/groupware
74
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 16Low 0
Watch
Add Tikiwiki Cms/groupware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-34111 | 9.8 | Jul 15 | An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector… Affected: through 15.1 |
| CVE-2010-4239 | 9.8 | Oct 28 | Tiki Wiki CMS Groupware 5.2 has Local File Inclusion Affected: 5.2 |
| CVE-2012-0911 | 9.8 | Jul 12 | TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to… Affected: before 6.7; before 8.4 |
| CVE-2020-29254 | 8.8 | Dec 11 | TikiWiki 21.2 allows templates to be edited without CSRF protection Affected: 21.2 |
| CVE-2010-4241 | 8.8 | Oct 28 | Tiki Wiki CMS Groupware 5.2 has CSRF Affected: 5.2 |
| CVE-2018-20719 | 8.8 | Jan 15 | In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter Affected: before 17.2 |
| CVE-2017-14925 | 8.0 | Sep 30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated… Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +15 more |
| CVE-2017-14924 | 8.0 | Sep 30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated… Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +15 more |
| CVE-2016-10143 | 7.5 | Jan 20 | A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field Affected: 15.2 |
| CVE-2020-8966 | 6.1 | Apr 1 | There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware Affected: through 20.0 |
| CVE-2013-6022 | 6.1 | Feb 12 | A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code Affected: through 11.0 |
| CVE-2011-4336 | 6.1 | Jan 15 | Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php Affected: through 7.0 |
| CVE-2010-4240 | 6.1 | Oct 28 | Tiki Wiki CMS Groupware 5.2 has XSS Affected: 5.2 |
| CVE-2016-7394 | 6.1 | Feb 6 | tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie Affected: through 15.2 |
| CVE-2017-9145 | 6.1 | Jun 26 | TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +17 more |
| CVE-2017-9305 | 6.1 | May 31 | lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on… Affected: 16.2 |
| CVE-2016-9889 | 6.1 | Dec 23 | Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized,… Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +8 more |
| CVE-2021-36551 | 5.4 | Oct 28 | TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php Affected: 21.4 |
| CVE-2021-36550 | 5.4 | Oct 28 | TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php Affected: 21.4 |
| CVE-2019-15314 | 5.4 | Aug 22 | tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI Affected: 18.4 |
| CVE-2018-14849 | 5.4 | Aug 13 | Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php Affected: 12.0 before 12.14; 15.0 before 15.7; 18.0 before 18.2 |
| CVE-2018-14850 | 5.4 | Aug 13 | Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki… Affected: 12.0 before 12.14; 15.0 before 15.7; 18.0 before 18.2 |
| CVE-2018-7290 | 5.4 | Mar 9 | Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1 Affected: 12.0 before 12.13; 15.0 before 15.6; 17.0 before 17.2; 18.0 |
| CVE-2018-7303 | 5.4 | Feb 21 | The Calendar component in Tiki 17.1 allows HTML injection Affected: 17.1 |
| CVE-2018-7188 | 5.4 | Feb 16 | An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG… Affected: before 18 |
| CVE-2013-4715 | – | Nov 6 | SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute… Affected: 6.8; 6.9; 6.10; 6.11; 6.12; 9.0; +18 more |
| CVE-2013-4714 | – | Nov 6 | Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to… Affected: 6.8; 6.9; 6.10; 6.11; 6.12; 9.0; +18 more |
| CVE-2012-5321 | – | Oct 8 | tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka… Affected: 8.3 |
| CVE-2011-4551 | – | Oct 1 | Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or… Affected: through 8.1; 2.2; 3.0; 3.1; 3.2; 3.3; +18 more |
| CVE-2012-3996 | – | Jul 12 | TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or… Affected: through 8.2; 2.2; 3.0; 3.1; 3.2; 3.3; +18 more |
| CVE-2010-1136 | – | Mar 27 | The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the… Affected: 3.0; 3.1; 3.2; 3.3; 3.4 |
| CVE-2010-1135 | – | Mar 27 | The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse Affected: 4.0; 4.1 |
| CVE-2010-1134 | – | Mar 27 | SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL commands via the… Affected: 3.0; 3.1; 3.2; 3.3; 3.4 |
| CVE-2010-1133 | – | Mar 27 | Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related… Affected: 4.0; 4.1 |
| CVE-2003-1574 | – | Aug 24 | TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me"… Affected: 1.6.1 |
| CVE-2009-1204 | – | Apr 1 | Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to… Affected: 2.2 |
| CVE-2008-5319 | – | Dec 3 | Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE-2008-3653 Affected: through 1.6.1 |
| CVE-2008-5318 | – | Dec 3 | Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653 Affected: through 1.6.1 |
| CVE-2008-3654 | – | Aug 13 | Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors Affected: through 1.9.9; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +9 more |
| CVE-2008-3653 | – | Aug 13 | Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors Affected: through 1.9.9; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +9 more |
| CVE-2008-1047 | – | Feb 27 | Cross-site scripting (XSS) vulnerability in tiki-edit_article.php in TikiWiki before 1.9.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 1.6.1 |
| CVE-2007-6526 | – | Dec 27 | Cross-site scripting (XSS) vulnerability in tiki-special_chars.php in TikiWiki before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via the area_name… Affected: through 1.9.8; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +7 more |
| CVE-2007-6529 | – | Dec 27 | Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) tiki-list_games.php, or (3)… Affected: through 1.9.8; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +7 more |
| CVE-2007-6528 | – | Dec 27 | Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a Affected: through 1.9.8; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +7 more |
| CVE-2007-5683 | – | Oct 26 | Multiple cross-site scripting (XSS) vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to… Affected: through 1.9.8.1; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +8 more |
| CVE-2007-5684 | – | Oct 26 | Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in (1)… Affected: through 1.9.8.1; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +8 more |
| CVE-2007-5682 | – | Oct 26 | Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable functions and variable… Affected: through 1.9.8; 1.6.1; 1.9.0; 1.9.0; 1.9.0; 1.9.0; +7 more |
| CVE-2007-5423 | – | Oct 12 | tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function Affected: 1.9.8 |
| CVE-2007-4554 | – | Aug 28 | Cross-site scripting (XSS) vulnerability in tiki-remind_password.php in Tikiwiki (aka Tiki CMS/Groupware) 1.9.7 allows remote attackers to inject arbitrary web script or HTML via… Affected: 1.9.7 |
| CVE-2006-6457 | – | Dec 11 | tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large… Affected: 1.9.2; 1.9.5 |