CVE-2024-46879 | Medium | 5.4 | 2026-03-23 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2. This vulnerability… |
CVE-2024-46878 | Medium | 5.4 | 2026-03-23 | A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. This vulnerability allows attack… |
CVE-2025-34111 | Critical | 9.8 | 2025-07-15 | An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connecto… |
CVE-2025-32461 | Critical | 9.9 | 2025-04-09 | wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2… |
CVE-2024-51509 | Medium | 4.8 | 2024-10-28 | Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored XSS payload in the Name. |
CVE-2024-51508 | Medium | 4.8 | 2024-10-28 | Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index. |
CVE-2024-51507 | Medium | 4.8 | 2024-10-28 | Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name. |
CVE-2024-51506 | Medium | 4.8 | 2024-10-28 | Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description. |
CVE-2023-22851 | High | 7.2 | 2023-01-14 | Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call. |
CVE-2023-22850 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call. |
CVE-2023-22853 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval. |
CVE-2023-22852 | Medium | 6.5 | 2023-01-14 | Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php. |
CVE-2021-36551 | Medium | 5.4 | 2021-10-28 | TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to… |
CVE-2021-36550 | Medium | 5.4 | 2021-10-28 | TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows atta… |
CVE-2020-29254 | High | 8.8 | 2020-12-11 | TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forge… |
CVE-2020-15906 | Critical | 9.8 | 2020-10-22 | tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. |
CVE-2020-16131 | Medium | 6.1 | 2020-08-03 | Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php. |
CVE-2020-8966 | Medium | 6.5 | 2020-04-01 | There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS a… |
CVE-2013-6022 | Medium | 6.1 | 2020-02-12 | A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user exe… |
CVE-2011-4558 | High | 7.2 | 2020-01-27 | Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters. |
CVE-2011-4336 | Medium | 6.1 | 2020-01-15 | Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php. |
CVE-2011-4455 | Medium | 6.1 | 2019-11-20 | Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) ti… |
CVE-2011-4454 | Medium | 6.1 | 2019-11-20 | Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1… |
CVE-2010-4241 | High | 8.8 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has CSRF |
CVE-2010-4240 | Medium | 6.1 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has XSS |
CVE-2010-4239 | Critical | 9.8 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has Local File Inclusion |
CVE-2019-15314 | Medium | 5.4 | 2019-08-22 | tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&f… |
CVE-2018-20719 | High | 8.8 | 2019-01-15 | In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter. |
CVE-2018-14850 | Medium | 5.4 | 2018-08-13 | Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administ… |
CVE-2018-14849 | Medium | 5.4 | 2018-08-13 | Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php. |
CVE-2018-7290 | Medium | 5.4 | 2018-03-09 | Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1. |
CVE-2018-7304 | High | 8.8 | 2018-02-21 | Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machi… |
CVE-2018-7303 | Medium | 5.4 | 2018-02-21 | The Calendar component in Tiki 17.1 allows HTML injection. |
CVE-2018-7302 | Medium | 5.4 | 2018-02-21 | Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS. |
CVE-2018-7188 | Medium | 5.4 | 2018-02-16 | An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page w… |
CVE-2016-7394 | Medium | 6.1 | 2018-02-06 | tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie. |
CVE-2017-14925 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2017-14924 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2017-9145 | Medium | 6.1 | 2017-06-26 | TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS. |
CVE-2017-9305 | Medium | 6.1 | 2017-05-31 | lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated… |
CVE-2016-10143 | High | 7.5 | 2017-01-20 | A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field. |
CVE-2016-9889 | Medium | 6.1 | 2016-12-23 | Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the… |
CVE-2013-4715 | | | 2013-11-06 | SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attacker… |
CVE-2013-4714 | | | 2013-11-06 | Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows re… |
CVE-2012-5321 | | | 2012-10-08 | tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the… |
CVE-2011-4551 | | | 2012-10-01 | Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbit… |
CVE-2012-3996 | | | 2012-07-12 | TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki… |
CVE-2012-0911 | Critical | 9.8 | 2012-07-12 | TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieNam… |
CVE-2010-1136 | | | 2010-03-27 | The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," prob… |
CVE-2010-1135 | | | 2010-03-27 | The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via… |
CVE-2010-1134 | | | 2010-03-27 | SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL co… |
CVE-2010-1133 | | | 2010-03-27 | Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vector… |
CVE-2003-1574 | | | 2009-08-24 | TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explo… |
CVE-2009-1204 | | | 2009-04-01 | Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF p… |
CVE-2008-5319 | | | 2008-12-03 | Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE-2008-3653. |
CVE-2008-5318 | | | 2008-12-03 | Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-200… |
CVE-2008-3654 | | | 2008-08-13 | Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors. |
CVE-2008-3653 | | | 2008-08-13 | Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors. |
CVE-2008-1047 | | | 2008-02-27 | Cross-site scripting (XSS) vulnerability in tiki-edit_article.php in TikiWiki before 1.9.10.1 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2007-6529 | | | 2007-12-27 | Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) tiki-list_games.php… |
CVE-2007-6528 | | | 2007-12-27 | Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) and modifi… |
CVE-2007-6526 | | | 2007-12-27 | Cross-site scripting (XSS) vulnerability in tiki-special_chars.php in TikiWiki before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2007-5684 | | | 2007-10-26 | Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute path… |
CVE-2007-5683 | | | 2007-10-26 | Multiple cross-site scripting (XSS) vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u… |
CVE-2007-5682 | | | 2007-10-26 | Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable fun… |
CVE-2007-5423 | | | 2007-10-12 | tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by c… |
CVE-2007-4554 | | | 2007-08-28 | Cross-site scripting (XSS) vulnerability in tiki-remind_password.php in Tikiwiki (aka Tiki CMS/Groupware) 1.9.7 allows remote attackers to inject arbitrary web… |
CVE-2006-6457 | | | 2006-12-11 | tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) v… |
CVE-2006-6168 | | | 2006-11-29 | tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separated list of address… |
CVE-2006-6163 | | | 2006-11-29 | Cross-site scripting (XSS) vulnerability in tiki-setup_base.php in TikiWiki before 1.9.7 allows remote attackers to inject arbitrary JavaScript via unspecified… |
CVE-2006-6162 | | | 2006-11-29 | Cross-site scripting (XSS) vulnerability in tiki-edit_structures.php in TikiWiki 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the p… |
CVE-2006-5703 | | | 2006-11-04 | Cross-site scripting (XSS) vulnerability in tiki-featured_link.php in Tikiwiki 1.9.5 allows remote attackers to inject arbitrary web script or HTML via a url p… |
CVE-2006-5702 | | | 2006-11-04 | Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php… |
CVE-2006-4734 | | | 2006-09-13 | Multiple SQL injection vulnerabilities in tiki-g-admin_processes.php in Tikiwiki 1.9.4 allow remote attackers to execute arbitrary SQL commands via the (1) pid… |
CVE-2006-4602 | | | 2006-09-07 | Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath pa… |
CVE-2006-4299 | | | 2006-08-23 | Cross-site scripting (XSS) vulnerability in tiki-searchindex.php in TikiWiki 1.9.4 allows remote attackers to inject arbitrary web script or HTML via the highl… |
CVE-2006-3048 | | | 2006-06-16 | SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vect… |
CVE-2006-3047 | | | 2006-06-16 | Cross-site scripting (XSS) vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via u… |
CVE-2006-2635 | | | 2006-05-30 | Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML vi… |
CVE-2005-3529 | | | 2005-11-20 | tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to obtain the installation path via an invalid topics_sort_mode parameter, p… |
CVE-2005-3528 | | | 2005-11-20 | Cross-site scripting (XSS) vulnerability in tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arbitrary web script o… |
CVE-2005-1925 | | | 2005-11-18 | Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands via (1) the suck_url… |
CVE-2005-3283 | | | 2005-10-23 | Cross-site scripting (XSS) vulnerability in TikiWiki before 1.9.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. |
CVE-2005-1921 | | | 2005-07-05 | Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as us… |
CVE-2005-0200 | | | 2005-05-02 | TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute… |
CVE-2004-1386 | | | 2004-12-31 | TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different v… |
CVE-2004-1928 | | | 2004-04-12 | The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/… |
CVE-2004-1925 | | | 2004-04-12 | Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort… |
CVE-2004-1927 | | | 2004-04-11 | Directory traversal vulnerability in the map feature (tiki-map.phtml) in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to determine t… |
CVE-2004-1926 | | | 2004-04-11 | Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Name, or (4) Displaye… |
CVE-2004-1924 | | | 2004-04-11 | Multiple cross-site scripting (XSS) vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to inject arbitrary web script or… |
CVE-2004-1923 | | | 2004-04-11 | Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to gain sensitive information via a direct request to (1) banner_click.php, (2) categor… |