Skip to content
Noroxi

Tiki records

91 published records for vendor tiki.

Researcher profile

Entered KEV
0 · 0%
Weaponized
6 · 6.6%
Pre-auth RCE
18
With a fix record
2.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

91 records
  • CVE-2012-0911
    60This week

    TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object i

    CriticalCVSS 9.8WeaponizedEPSS 62%

    tiki · tikiwiki cms\/groupwareJul 12, 2012

  • CVE-2025-34111
    60This week

    Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE

    CriticalCVSS 9.3WeaponizedEPSS 2%

    tiki · tikiwiki cms\/groupwareJul 15, 2025

  • CVE-2005-1921
    54Plan

    Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1

    HighCVSS 7.5WeaponizedEPSS 79%

    php · xml rpcJul 5, 2005

  • CVE-2007-5423
    53Plan

    tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which

    HighCVSS 7.5WeaponizedEPSS 76%

    tiki · tikiwiki cms\/groupwareOct 12, 2007

  • CVE-2020-15906
    47Plan

    tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    tiki · tikiOct 22, 2020

  • CVE-2006-4602
    43Plan

    Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP cod

    HighCVSS 7.5WeaponizedEPSS 44%

    tiki · tikiwiki cms\/groupwareSep 6, 2006

  • CVE-2010-4239
    43Plan

    Tiki Wiki CMS Groupware 5.2 has Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    tiki · tikiwiki cms\/groupwareOct 28, 2019

  • CVE-2007-6529
    41Plan

    Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) ti

    CriticalCVSS 10.0No exploitEPSS 1%

    tiki · tikiwiki cms\/groupwareDec 27, 2007

  • CVE-2006-5702
    40Plan

    Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1)

    MediumCVSS 5.0WeaponizedEPSS 53%

    tiki · tikiwiki cms\/groupwareNov 3, 2006

  • CVE-2008-3653
    40Plan

    Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors.

    CriticalCVSS 10.0No exploitEPSS 1%

    tiki · tikiwiki cms\/groupwareAug 12, 2008

  • CVE-2020-29254
    35Monitor

    TikiWiki 21.2 allows templates to be edited without CSRF protection.

    HighCVSS 8.8Proof of conceptEPSS 1%

    tiki · tikiwiki cms\/groupwareDec 11, 2020

  • CVE-2018-7304
    35Monitor

    Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window

    HighCVSS 8.8No exploitEPSS 1%

    tiki · tikiFeb 21, 2018

  • CVE-2023-22850
    35Monitor

    Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.

    HighCVSS 8.8No exploitEPSS 1%

    tiki · tikiJan 13, 2023

  • CVE-2018-20719
    35Monitor

    In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.

    HighCVSS 8.8No exploitEPSS 0%

    tiki · tikiwiki cms\/groupwareJan 15, 2019

  • CVE-2023-22853
    35Monitor

    Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval.

    HighCVSS 8.8No exploitEPSS 0%

    tiki · tikiJan 13, 2023

  • CVE-2010-4241
    35Monitor

    Tiki Wiki CMS Groupware 5.2 has CSRF

    HighCVSS 8.8No exploitEPSS 0%

    tiki · tikiwiki cms\/groupwareOct 28, 2019

  • CVE-2004-1926
    32Monitor

    Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Na

    HighCVSS 7.5Proof of conceptEPSS 7%

    tiki · tikiwiki cms\/groupwareApr 11, 2004

  • CVE-2017-14925
    32Monitor

    Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS b

    HighCVSS 8.0No exploitEPSS 0%

    tiki · tikiwiki cms\/groupwareSep 29, 2017

  • CVE-2017-14924
    32Monitor

    Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS b

    HighCVSS 8.0No exploitEPSS 0%

    tiki · tikiwiki cms\/groupwareSep 29, 2017

  • CVE-2004-1928
    31Monitor

    The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary

    HighCVSS 7.5Proof of conceptEPSS 3%

    tiki · tikiwiki cms\/groupwareApr 12, 2004

  • CVE-2007-5684
    31Monitor

    Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files v

    HighCVSS 7.5Proof of conceptEPSS 3%

    tiki · tikiwiki cms\/groupwareOct 26, 2007

  • CVE-2005-1925
    31Monitor

    Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands vi

    HighCVSS 7.5No exploitEPSS 2%

    tiki · tikiwiki cms\/groupwareNov 18, 2005

  • CVE-2007-5682
    31Monitor

    Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by

    HighCVSS 7.5No exploitEPSS 2%

    tiki · tikiwiki cms\/groupwareOct 26, 2007

  • CVE-2005-0200
    31Monitor

    TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to

    HighCVSS 7.5No exploitEPSS 2%

    tiki · tikiwiki cms\/groupwareMay 2, 2005

  • CVE-2006-6168
    31Monitor

    tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separa

    HighCVSS 7.5No exploitEPSS 2%

    tiki · tikiwiki cms\/groupwareNov 28, 2006