Priority MEDIUM 58
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00203 · Published 2026-03-23 · No fix listed CWE-79
Priority MEDIUM 58
A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00203 · Published 2026-03-23 · No fix listed CWE-79
Priority MEDIUM 53
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to u…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.02574 · Published 2025-07-15 · No fix listed CWE-20
Priority MEDIUM 45
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00939 · Published 2025-04-09 · Fixed in 21.12, 24.8 +2 CWE-1336
Priority LOW 39
Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00522 · Published 2024-12-30 · Fixed in version 28. CWE-79
Priority MEDIUM 52
Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01589 · Published 2024-12-30 · Fixed in version 28. CWE-78
Priority LOW 27
Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00315 · Published 2024-12-30 · Fixed in version 28 CWE-78
Priority MEDIUM 55
Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored XSS payload in the Name.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00234 · Published 2024-10-28 · No fix listed CWE-79
Priority MEDIUM 55
Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00256 · Published 2024-10-28 · No fix listed CWE-79
Priority MEDIUM 55
Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00256 · Published 2024-10-28 · No fix listed CWE-79
Priority MEDIUM 55
Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00234 · Published 2024-10-28 · No fix listed CWE-79
Priority MEDIUM 42
Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00964 · Published 2023-01-14 · No fix listed CWE-94
Priority LOW 29
Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00324 · Published 2023-01-14 · No fix listed CWE-352
Priority HIGH 67
Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01059 · Published 2023-01-14 · No fix listed CWE-434
Priority HIGH 73
Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0118 · Published 2023-01-14 · No fix listed CWE-502
Priority LOW 25
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00503 · Published 2021-10-28 · No fix listed CWE-79
Priority LOW 25
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00503 · Published 2021-10-28 · No fix listed CWE-79
Priority MEDIUM 41
TikiWiki 21.2 allows templates to be edited without CSRF protection.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.015 · Published 2020-12-11 · No fix listed CWE-352
Priority MEDIUM 64
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.2716 · Published 2020-10-22 · No fix listed CWE-307
Priority LOW 28
Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00685 · Published 2020-08-03 · No fix listed CWE-79
Priority LOW 30
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00869 · Published 2020-04-01 · No fix listed CWE-80
Priority LOW 30
A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01354 · Published 2020-02-12 · No fix listed CWE-79
Priority LOW 39
Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.04271 · Published 2020-01-27 · No fix listed CWE-74
Priority LOW 38
Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.07652 · Published 2020-01-15 · No fix listed CWE-79
Priority LOW 29
Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php, (2) tiki-pagehistory.php, (3) tiki-remov…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00949 · Published 2019-11-20 · No fix listed CWE-79
Load more
THREATIST.IORead the docs