CVE-2009-1204

Cross-site scripting XSS vulnerability in TikiWiki Tiki CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHPSELF portion of a URI to 1 tiki-galleries.php, 2 tiki-listfilegallery.php, 3 tiki-listpages.php, and 4 tiki-orphanpages.php...

CVE-2007-4554: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in tiki-remindpassword.php in Tikiwiki aka Tiki CMS/Groupware 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: this issue might be related to CVE-2006-2635.7...

CVE-2004-1924: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via via the 1 theme parameter to tiki-switchtheme.php, 2 find and priority parameters to messu-mailbox.php, 3 flag, priority, flagval,...

CVE-2004-1927: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the map feature tiki-map.phtml in Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to determine the existence of arbitrary files via .. dot dot sequences in the mapfile parameter...

CVE-2004-1926: Improper Control of Generation of Code

Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to inject arbitrary code via the 1 Theme, 2 Country, 3 Real Name, or 4 Displayed time zone fields in a User Profile, or the 5 Name, 6 Description, 7 URL, or 8 Country fields in a Directory/Add Site operation...

CVE-2004-1925: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sortmode parameter in 1 tiki-usermenu.php, 2 tiki-listfilegallery.php, 3 tiki-directoryranking.php, 4 tiki-browsecategories.php, 5 tiki-index.ph...

CVE-2004-1928: Improper Input Validation

The image upload feature in Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wikiup URL...

CVE-2004-1923: Exposure of Sensitive Information to an Unauthorized Actor

Tiki CMS/Groupware TikiWiki 1.8.1 and earlier allows remote attackers to gain sensitive information via a direct request to 1 bannerclick.php, 2 categorize.php, 3 tiki-adminincludedirectory.php, 4 tiki-directorysearch.php, which reveal the web server path in an error message...