CVE-2025-34113 Tiki Wiki CMS Authenticated Command Injection in Calendar Module

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...

CVE-2025-34113

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...

CVE-2025-34113

CVE-2025-34113 describes an authenticated command-injection in Tiki Wiki CMS via the viewmode parameter in tiki-calendar.php. Affected versions are listed as ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14; the calendar module must be enabled and the user must have access permissions. Successful exploitat...

CVE-2025-34113 Tiki Wiki CMS Authenticated Command Injection in Calendar Module

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...

PT-2025-29553 · Unknown +1 · Tikiwiki Cms/Groupware +1

Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS Groupware versions 15.1 and earlier Description: An unauthenticated arbitrary file upload issue exists in the Tiki Wiki CMS Groupware software. The vulnerability is located within the ELFinder component’s default connector...

PT-2025-29555 · Unknown · Tiki Wiki Cms

Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS versions 6.14 and earlier Tiki Wiki CMS versions 9.10 LTS and earlier Tiki Wiki CMS versions 12.4 LTS and earlier Tiki Wiki CMS versions 14.1 and earlier Description: An authenticated command injection vulnerability exists in Ti...

Tiki Wiki CMS 安全漏洞

Tiki Wiki CMS is a content management system from Tiki Inc. A security vulnerability exists in Tiki Wiki CMS versions 14.1, 12.4 LTS, 9.10 LTS, and 6.14, which stems from improper validation of the viewmode parameter input and could lead to command injection...

CVE-2025-34113: Missing Authentication for Critical Function

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...

CVE-2025-34111: Unrestricted Upload of File with Dangerous Type

An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector connector.minimal.php, which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The...

Tiki Wiki CMS Groupware 安全漏洞

Tiki Wiki CMS Groupware is an open source Wiki-based content management system and online office suite. A security vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier, which stems from improper validation of file types in the ELFinder component and could lead to arbitrary fil...

PT-2025-50550

Name of the Vulnerable Software and Affected Versions XWiki versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2, and 17.5.0-rc-1 through 17.5.0 Description The XWiki Rendering system lacks sufficient protection against /html injection. This allows attackers to achieve remote code execution RCE...

📄 Tiki Wiki CMS Groupware 28.3 Server-Side Template Injection

Tiki Wiki CMS Groupware versions 28.3 and below suffer from two server-side template injection vulnerabilities via specially crafted wiki pages. ---------------------------------------------------------------------------------- Tiki Wiki CMS Groupware '" The second vulnerability can be leveraged ...

MediaWiki Security Breach

MediaWiki is a set of free and freely available web-based Wiki engines from the American Wikimedia Wikimedia Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki suffers from a security vulnerability that stems from allowing any use...

Wikimedia Mediawiki - SecurePoll extension 跨站请求伪造漏洞

Wikimedia Mediawiki - SecurePoll extension is a special page extension for elections, polls and surveys from the Wikimedia Foundation. A cross-site request forgery vulnerability exists in the Wikimedia Mediawiki - SecurePoll extension versions prior to 1.39.13, prior to 1.42.7, and prior to 1.43....

Malware in wiki-edit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5481 Malicious code in wiki-edit (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1ceb97b63413b094efbe0bbad468ef89f1617ca751fb66f51d9ae7c3f94a9c1 Any computer that has this package installed or running should be considered...

[SECURITY] Fedora 42 Update: mediawiki-1.43.1-1.fc42

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

XWiki allows remote code execution through default value of wiki macro wiki-type parameters

Impact Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation and thus impacts its confidentiality, integrity and availability. The main probl...

CVE-2025-49581

XWiki is a generic wiki platform. Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter...

CVE-2025-49581 XWiki allows remote code execution through default value of wiki macro wiki-type parameters

XWiki is a generic wiki platform. Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter...