Login Request a demo
TI
Vendor
Tiki
2 products with CVEs on record
91
CVEs
0
On KEV
0
New 30D
Products
TC
Tikiwiki Cms/groupware
Tiki
9.8
74 CVEs0 on KEV0 new
TI
Tiki
Tiki
9.8
17 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2024-46878
TI
Tiki
Tiki
5.4
0%
Mar 23A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier
CVE-2024-46879
TI
Tiki
Tiki
5.4
0%
Mar 23A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2
CVE-2025-34111
TC
Tikiwiki Cms/groupware
Tiki
9.8
3%
Jul 15An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector…
CVE-2024-51509
TI
Tiki
Tiki
4.8
0%
Oct 28Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored XSS payload in the Name
CVE-2024-51508
TI
Tiki
Tiki
4.8
0%
Oct 28Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index
CVE-2024-51507
TI
Tiki
Tiki
4.8
0%
Oct 28Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name
CVE-2024-51506
TI
Tiki
Tiki
4.8
0%
Oct 28Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description
CVE-2023-22851
TI
Tiki
Tiki
7.2
1%
Jan 14Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call
CVE-2023-22850
TI
Tiki
Tiki
8.8
1%
Jan 14Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call
CVE-2023-22853
TI
Tiki
Tiki
8.8
1%
Jan 14Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval
CVE-2023-22852
TI
Tiki
Tiki
6.5
0%
Jan 14Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php
CVE-2021-36551
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Oct 28TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php
CVE-2021-36550
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Oct 28TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php
CVE-2020-29254
TC
Tikiwiki Cms/groupware
Tiki
8.8
2%
Dec 11TikiWiki 21.2 allows templates to be edited without CSRF protection
CVE-2020-15906
TI
Tiki
Tiki
9.8
27%
Oct 22tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts
CVE-2020-16131
TI
Tiki
Tiki
6.1
1%
Aug 3Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php
CVE-2020-8966
TC
Tikiwiki Cms/groupware
Tiki
6.1
1%
Apr 1There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware
CVE-2013-6022
TC
Tikiwiki Cms/groupware
Tiki
6.1
1%
Feb 12A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code
CVE-2011-4558
TI
Tiki
Tiki
7.2
4%
Jan 27Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters
CVE-2011-4336
TC
Tikiwiki Cms/groupware
Tiki
6.1
8%
Jan 15Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php
CVE-2011-4455
TI
Tiki
Tiki
6.1
1%
Nov 20Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php,…
CVE-2011-4454
TI
Tiki
Tiki
6.1
1%
Nov 20Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1)…
CVE-2010-4241
TC
Tikiwiki Cms/groupware
Tiki
8.8
1%
Oct 28Tiki Wiki CMS Groupware 5.2 has CSRF
CVE-2010-4240
TC
Tikiwiki Cms/groupware
Tiki
6.1
1%
Oct 28Tiki Wiki CMS Groupware 5.2 has XSS
CVE-2010-4239
TC
Tikiwiki Cms/groupware
Tiki
9.8
13%
Oct 28Tiki Wiki CMS Groupware 5.2 has Local File Inclusion
CVE-2019-15314
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Aug 22tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI
CVE-2018-20719
TC
Tikiwiki Cms/groupware
Tiki
8.8
1%
Jan 15In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter
CVE-2018-14849
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Aug 13Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php
CVE-2018-14850
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Aug 13Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki…
CVE-2018-7290
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Mar 9Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1
CVE-2018-7304
TI
Tiki
Tiki
8.8
1%
Feb 21Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform…
CVE-2018-7303
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Feb 21The Calendar component in Tiki 17.1 allows HTML injection
CVE-2018-7302
TI
Tiki
Tiki
5.4
1%
Feb 21Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS
CVE-2018-7188
TC
Tikiwiki Cms/groupware
Tiki
5.4
1%
Feb 16An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG…
CVE-2016-7394
TC
Tikiwiki Cms/groupware
Tiki
6.1
1%
Feb 6tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie
CVE-2017-14925
TC
Tikiwiki Cms/groupware
Tiki
8.0
1%
Sep 30Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated…
CVE-2017-14924
TC
Tikiwiki Cms/groupware
Tiki
8.0
0%
Sep 30Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated…
CVE-2017-9145
TC
Tikiwiki Cms/groupware
Tiki
6.1
1%
Jun 26TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS
CVE-2017-9305
TC
Tikiwiki Cms/groupware
Tiki
6.1
1%
May 31lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on…
CVE-2016-10143
TC
Tikiwiki Cms/groupware
Tiki
7.5
2%
Jan 20A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field
CVE-2016-9889
TC
Tikiwiki Cms/groupware
Tiki
6.1
1%
Dec 23Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized,…
CVE-2013-4715
TC
Tikiwiki Cms/groupware
Tiki
–
2%
Nov 6SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute…
CVE-2013-4714
TC
Tikiwiki Cms/groupware
Tiki
–
1%
Nov 6Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to…
CVE-2012-5321
TC
Tikiwiki Cms/groupware
Tiki
–
14%
Oct 8tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka…
CVE-2011-4551
TC
Tikiwiki Cms/groupware
Tiki
–
2%
Oct 1Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or…
CVE-2012-3996
TC
Tikiwiki Cms/groupware
Tiki
–
5%
Jul 12TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or…
CVE-2012-0911
TC
Tikiwiki Cms/groupware
Tiki
9.8
63%
Jul 12TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to…
CVE-2010-1136
TC
Tikiwiki Cms/groupware
Tiki
–
2%
Mar 27The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the…
CVE-2010-1135
TC
Tikiwiki Cms/groupware
Tiki
–
2%
Mar 27The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse
CVE-2010-1134
TC
Tikiwiki Cms/groupware
Tiki
–
1%
Mar 27SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL commands via the…
CVE-2010-1133
TC
Tikiwiki Cms/groupware
Tiki
–
1%
Mar 27Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related…
CVE-2003-1574
TC
Tikiwiki Cms/groupware
Tiki
–
2%
Aug 24TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me"…
CVE-2009-1204
TC
Tikiwiki Cms/groupware
Tiki
–
5%
Apr 1Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to…
CVE-2008-5319
TC
Tikiwiki Cms/groupware
Tiki
–
1%
Dec 3Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE-2008-3653
CVE-2008-5318
TC
Tikiwiki Cms/groupware
Tiki
–
1%
Dec 3Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653
CVE-2008-3653
TC
Tikiwiki Cms/groupware
Tiki
–
2%
Aug 13Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors
CVE-2008-3654
TC
Tikiwiki Cms/groupware
Tiki
–
1%
Aug 13Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors
CVE-2008-1047
TC
Tikiwiki Cms/groupware
Tiki
–
1%
Feb 27Cross-site scripting (XSS) vulnerability in tiki-edit_article.php in TikiWiki before 1.9.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified…
CVE-2007-6528
TC
Tikiwiki Cms/groupware
Tiki
–
9%
Dec 27Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a
CVE-2007-6529
TC
Tikiwiki Cms/groupware
Tiki
–
2%
Dec 27Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) tiki-list_games.php, or (3)…