Tikiwiki Cmsgroupware
By the Year
In 2024 there have been 0 vulnerabilities in Tikiwiki Cmsgroupware . Tikiwiki Cmsgroupware did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 2 | 5.40 |
| 2020 | 2 | 7.45 |
| 2019 | 2 | 7.10 |
| 2018 | 5 | 5.40 |
It may take a day or so for new Tikiwiki Cmsgroupware vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Tikiwiki Cmsgroupware Security Vulnerabilities
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php
CVE-2021-36550
5.4 - Medium
- October 28, 2021
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module.
XSS
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php
CVE-2021-36551
5.4 - Medium
- October 28, 2021
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module.
XSS
TikiWiki 21.2 allows templates to be edited without CSRF protection
CVE-2020-29254
8.8 - High
- December 11, 2020
TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These action include allowing attackers to submit their own code through an authenticated user resulting in local file Inclusion. If an authenticated user who is able to edit TikiWiki templates visits an malicious website, template code can be edited.
Session Riding
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware
CVE-2020-8966
6.1 - Medium
- April 01, 2020
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.
XSS
tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code
CVE-2019-15314
5.4 - Medium
- August 22, 2019
tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.
XSS
In Tiki before 17.2, the user task component is vulnerable to a SQL Injection
CVE-2018-20719
8.8 - High
- January 15, 2019
In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
SQL Injection
Tiki before 18.2, 15.7 and 12.14 has XSS
CVE-2018-14849
5.4 - Medium
- August 13, 2018
Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.
XSS
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14
CVE-2018-14850
5.4 - Medium
- August 13, 2018
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.
XSS
Cross Site Scripting (XSS) exists in Tiki before 12.13
CVE-2018-7290
5.4 - Medium
- March 09, 2018
Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1.
XSS
The Calendar component in Tiki 17.1
CVE-2018-7303
5.4 - Medium
- February 21, 2018
The Calendar component in Tiki 17.1 allows HTML injection.
XSS
An XSS vulnerability (via an SVG image) in Tiki before 18
CVE-2018-7188
5.4 - Medium
- February 16, 2018
An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php.
XSS
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4
CVE-2012-0911
9.8 - Critical
- July 12, 2012
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.
Marshaling, Unmarshaling
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others
CVE-2005-1921
- July 05, 2005
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Code Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Debian Linux or by Tiki? Click the Watch button to subscribe.
