CVE-2019-15314

tiki/tiki-uploadfile.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-downloadfile.php?display= URI...