567 matches found
CVE-2025-34113 Tiki Wiki CMS Authenticated Command Injection in Calendar Module
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...
CVE-2025-34113 Tiki Wiki CMS Authenticated Command Injection in Calendar Module
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...
CVE-2025-34113
CVE-2025-34113 describes an authenticated command-injection in Tiki Wiki CMS via the viewmode parameter in tiki-calendar.php. Affected versions are listed as ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14; the calendar module must be enabled and the user must have access permissions. Successful exploitat...
CVE-2025-34113
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...
Tiki Wiki CMS Groupware 安全漏洞
Tiki Wiki CMS Groupware is an open source Wiki-based content management system and online office suite. A security vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier, which stems from improper validation of file types in the ELFinder component and could lead to arbitrary fil...
PT-2025-29553 · Unknown +1 · Tikiwiki Cms/Groupware +1
Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS Groupware versions 15.1 and earlier Description: An unauthenticated arbitrary file upload issue exists in the Tiki Wiki CMS Groupware software. The vulnerability is located within the ELFinder component’s default connector...
PT-2025-29555 · Unknown · Tiki Wiki Cms
Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS versions 6.14 and earlier Tiki Wiki CMS versions 9.10 LTS and earlier Tiki Wiki CMS versions 12.4 LTS and earlier Tiki Wiki CMS versions 14.1 and earlier Description: An authenticated command injection vulnerability exists in Ti...
Tiki Wiki CMS 安全漏洞
Tiki Wiki CMS is a content management system from Tiki Inc. A security vulnerability exists in Tiki Wiki CMS versions 14.1, 12.4 LTS, 9.10 LTS, and 6.14, which stems from improper validation of the viewmode parameter input and could lead to command injection...
📄 Tiki Wiki CMS Groupware 28.3 Server-Side Template Injection
Tiki Wiki CMS Groupware versions 28.3 and below suffer from two server-side template injection vulnerabilities via specially crafted wiki pages. ---------------------------------------------------------------------------------- Tiki Wiki CMS Groupware '" The second vulnerability can be leveraged ...
CVE-2024-51506
Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description...
CVE-2024-51509
Tiki through 27.0 allows users who have certain permissions to insert a "Modules" aka tiki-adminmodules.php stored XSS payload in the Name...
CVE-2024-51507
Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name...
CVE-2024-51508
Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index...
CVE-2023-22852
Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-importsheet.php...
CVE-2023-22850
Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call...
CVE-2023-22851
Tiki before 24.2 allows lib/importer/tikiimporterblogwordpress.php PHP Object Injection by an admin because of an unserialize call...
CVE-2023-22853
Tiki before 24.1, when featurecreatewebhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval...
CVE-2020-16131
Tiki before 21.2 allows XSS because \s/"' is not properly considered in lib/core/TikiFilter/PreventXss.php...