Read the docs
TI-2013-04135 Aliases CVE-2013-4714GHSA-h7jc-pg2r-mqj4

Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS…

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Why it matters now

EPSS 0.01156 67th percentileScored 2026-11-07
Fix Fixed tikiwiki/tiki-manager (Packagist): 6.13, 9.7, 10.4 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—tikiwiki/tiki-manager (Packagist)6.0 to before 6.136.13Patch availableGHSA-h7jc-pg2r-mqj4
—tikiwiki/tiki-manager (Packagist)9.0 to before 9.79.7Patch availableGHSA-h7jc-pg2r-mqj4
—tikiwiki/tiki-manager (Packagist)10.0 to before 10.410.4Patch availableGHSA-h7jc-pg2r-mqj4
—tikiwiki/tiki-manager (Packagist)11.0 to before 11.111.1Patch availableGHSA-h7jc-pg2r-mqj4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • tikiwiki/tiki-manager (Packagist) Vendor— Affected 6.0 to before 6.13 Fixed in 6.13 Patch available GHSA-h7jc-pg2r-mqj4
  • tikiwiki/tiki-manager (Packagist) Vendor— Affected 9.0 to before 9.7 Fixed in 9.7 Patch available GHSA-h7jc-pg2r-mqj4
  • tikiwiki/tiki-manager (Packagist) Vendor— Affected 10.0 to before 10.4 Fixed in 10.4 Patch available GHSA-h7jc-pg2r-mqj4
  • tikiwiki/tiki-manager (Packagist) Vendor— Affected 11.0 to before 11.1 Fixed in 11.1 Patch available GHSA-h7jc-pg2r-mqj4

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.8:-:lts:*:*:*:*:*6.8VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.9:-:lts:*:*:*:*:*6.9VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.10:-:lts:*:*:*:*:*6.10VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.11:-:lts:*:*:*:*:*6.11VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.12:-:lts:*:*:*:*:*6.12VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:-:lts:*:*:*:*:*9.0VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:alpha:lts:*:*:*:*:*9.0 alphaVulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:beta:lts:*:*:*:*:*9.0 betaVulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:beta2:lts:*:*:*:*:*9.0 beta2VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.1:-:lts:*:*:*:*:*9.1VulnerableTiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.8:-:lts:*:*:*:*:* Versions 6.8 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.9:-:lts:*:*:*:*:* Versions 6.9 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.10:-:lts:*:*:*:*:* Versions 6.10 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.11:-:lts:*:*:*:*:* Versions 6.11 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:6.12:-:lts:*:*:*:*:* Versions 6.12 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:-:lts:*:*:*:*:* Versions 9.0 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:alpha:lts:*:*:*:*:* Versions 9.0 alpha Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:beta:lts:*:*:*:*:* Versions 9.0 beta Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.0:beta2:lts:*:*:*:*:* Versions 9.0 beta2 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.1:-:lts:*:*:*:*:* Versions 9.1 Vulnerable ·Tiki Wiki
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.2:-:lts:*:*:*:*:*9.2VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.2:beta1:lts:*:*:*:*:*9.2 beta1VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.3:-:lts:*:*:*:*:*9.3VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.4:-:lts:*:*:*:*:*9.4VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.5:-:lts:*:*:*:*:*9.5VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.6:-:lts:*:*:*:*:*9.6VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.0:*:*:*:*:*:*:*10.0VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.0:alpha:*:*:*:*:*:*10.0 alphaVulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.0:beta:*:*:*:*:*:*10.0 betaVulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.1:*:*:*:*:*:*:*10.1VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.2:*:*:*:*:*:*:*10.2VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.3:*:*:*:*:*:*:*10.3VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:11.0:*:*:*:*:*:*:*11.0VulnerableTiki Wiki
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:11.0:beta:*:*:*:*:*:*11.0 betaVulnerableTiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.2:-:lts:*:*:*:*:* Versions 9.2 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.2:beta1:lts:*:*:*:*:* Versions 9.2 beta1 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.3:-:lts:*:*:*:*:* Versions 9.3 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.4:-:lts:*:*:*:*:* Versions 9.4 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.5:-:lts:*:*:*:*:* Versions 9.5 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:9.6:-:lts:*:*:*:*:* Versions 9.6 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.0:alpha:*:*:*:*:*:* Versions 10.0 alpha Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.0:beta:*:*:*:*:*:* Versions 10.0 beta Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Tiki Wiki
  • cpe:2.3:a:tiki:tikiwiki_cms\/groupware:11.0:beta:*:*:*:*:*:* Versions 11.0 beta Vulnerable ·Tiki Wiki

Remediation

  • Fix · GHSA-h7jc-pg2r-mqj4 tikiwiki/tiki-manager (Packagist) Fixed in 6.13 Advisory →
  • Fix · GHSA-h7jc-pg2r-mqj4 tikiwiki/tiki-manager (Packagist) Fixed in 9.7 Advisory →
  • Fix · GHSA-h7jc-pg2r-mqj4 tikiwiki/tiki-manager (Packagist) Fixed in 10.4 Advisory →
  • Fix · GHSA-h7jc-pg2r-mqj4 tikiwiki/tiki-manager (Packagist) Fixed in 11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4714
  2. 2026-10-03 Alias added: GHSA-h7jc-pg2r-mqj4

References

Advisory 3

Other 3

  • TI-2012-00837 TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute… CVSS 3.1CRITICAL 9.8
  • TI-2005-01820 Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc)… CVSS 2.0HIGH 7.5
  • TI-2007-05209 tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
  • TI-2006-04448 Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier… CVSS 2.0HIGH 7.5
  • TI-2010-03989 Tiki Wiki CMS Groupware 5.2 has Local File Inclusion CVSS 3.1CRITICAL 9.8
  • TI-2006-05487 Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username… CVSS 2.0MEDIUM 5.0
See all 73 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences