TC
Product
Tikiwiki Cms/groupware
74
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 16Low 0
Watch
Add Tikiwiki Cms/groupware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-8966 | 6.1 | Apr 1 | There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware Affected: through 20.0 |
| CVE-2013-6022 | 6.1 | Feb 12 | A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code Affected: through 11.0 |
| CVE-2011-4336 | 6.1 | Jan 15 | Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php Affected: through 7.0 |
| CVE-2010-4240 | 6.1 | Oct 28 | Tiki Wiki CMS Groupware 5.2 has XSS Affected: 5.2 |
| CVE-2016-7394 | 6.1 | Feb 6 | tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie Affected: through 15.2 |
| CVE-2017-9145 | 6.1 | Jun 26 | TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +17 more |
| CVE-2017-9305 | 6.1 | May 31 | lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on… Affected: 16.2 |
| CVE-2016-9889 | 6.1 | Dec 23 | Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized,… Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +8 more |
| CVE-2021-36551 | 5.4 | Oct 28 | TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php Affected: 21.4 |
| CVE-2021-36550 | 5.4 | Oct 28 | TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php Affected: 21.4 |
| CVE-2019-15314 | 5.4 | Aug 22 | tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI Affected: 18.4 |
| CVE-2018-14849 | 5.4 | Aug 13 | Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php Affected: 12.0 before 12.14; 15.0 before 15.7; 18.0 before 18.2 |
| CVE-2018-14850 | 5.4 | Aug 13 | Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki… Affected: 12.0 before 12.14; 15.0 before 15.7; 18.0 before 18.2 |
| CVE-2018-7290 | 5.4 | Mar 9 | Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1 Affected: 12.0 before 12.13; 15.0 before 15.6; 17.0 before 17.2; 18.0 |
| CVE-2018-7303 | 5.4 | Feb 21 | The Calendar component in Tiki 17.1 allows HTML injection Affected: 17.1 |
| CVE-2018-7188 | 5.4 | Feb 16 | An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG… Affected: before 18 |
Showing 16