571 matches found
CVE-2018-7304
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation...
CVE-2018-7302
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS...
CVE-2018-7302
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS...
CVE-2018-7304
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation...
Cross site scripting
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS...
Design/Logic Flaw
The Calendar component in Tiki 17.1 allows HTML injection...
Input validation
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation...
CVE-2018-7303
The Calendar component in Tiki 17.1 allows HTML injection...
CVE-2018-7302
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS...
CVE-2018-7303
The Calendar component in Tiki 17.1 allows HTML injection...
CVE-2018-7304
CVE-2018-7304 affects Tiki Wiki CMS Groupware (Tiki) version 17.1. The vulnerability arises because the application does not validate user input containing special characters in CSV fields, enabling CSV Injection that can trigger commands on the victim’s machine (for example, an input payload lik...
CVE-2018-7302
CVE-2018-7302 affects Tiki Wiki CMS Groupware 17.1. The issue arises when a PNG upload is actually SVG content, enabling cross-site scripting (XSS). Data from multiple sources confirms the vulnerability, with the impact described as XSS and the CVSS vectors indicating network attack with low to m...
CVE-2018-7303
CVE-2018-7303 concerns the Calendar component in Tiki 17.1, where HTML input from users is not properly filtered, enabling HTML injection. The primary documented impact is cross-site scripting risk via the Calendar module. The CVSS details indicate network access with low to moderate complexity a...
CVE-2018-7188
An XSS vulnerability via an SVG image in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php...
CVE-2018-7188
An XSS vulnerability via an SVG image in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php...
Cross site scripting
An XSS vulnerability via an SVG image in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php...
CVE-2018-7188
CVE-2018-7188 describes an XSS vulnerability in Tiki Wiki CMS Groupware prior to version 18. An authenticated user can gain administrator privileges if an administrator opens a wiki page containing a malicious SVG image, related to lib/filegals/filegallib.php. The impact is elevated privileges fo...
CVE-2018-7188
An XSS vulnerability via an SVG image in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php...
Tiki Wiki CMS Groupware cross-site scripting vulnerability (CNVD-2018-05522)
Tiki Wiki CMS Groupware is a suite of open source content management and portal applications from the Tiki software community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in Tiki Wiki CMS Groupware 15.2...