Tiki vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-32461 wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval.Critical 9.9 · Apr 8, 2025
• CVE-2023-22850 Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.High 8.8 · Jan 13, 2023
• CVE-2023-22853 Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval.High 8.8 · Jan 13, 2023
• CVE-2020-29254 TikiWiki 21.2 allows templates to be edited without CSRF protection.High 8.8 · Dec 11, 2020
• CVE-2020-15906 tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.Critical 9.8 · Oct 22, 2020
• CVE-2011-4558 Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters.High 7.2 · Jan 27, 2020
• CVE-2018-20719 In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.High 8.8 · Jan 15, 2019
• CVE-2018-7304 Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machinHigh 8.8 · Feb 21, 2018
• CVE-2017-14925 Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allowHigh 8 · Sep 29, 2017
• CVE-2017-14924 Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allowHigh 8 · Sep 29, 2017
• CVE-2016-10143 A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.High 7.5 · Jan 20, 2017
• CVE-2013-4715 SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackersHigh 7.5 · Nov 6, 2013
• CVE-2012-0911 TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieNameCritical 9.8 · Jul 12, 2012
• CVE-2010-1136 The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probaHigh 7.5 · Mar 27, 2010
• CVE-2010-1135 The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via High 7.5 · Mar 27, 2010
• CVE-2010-1134 SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL comHigh 7.5 · Mar 27, 2010
• CVE-2010-1133 Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectorsHigh 7.5 · Mar 27, 2010
• CVE-2003-1574 TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet ExplorHigh 7.5 · Aug 24, 2009
• CVE-2008-3653 Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors.High 10 · Aug 12, 2008
• CVE-2007-6529 Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) tiki-list_games.php, oHigh 10 · Dec 27, 2007
• CVE-2007-5682 Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable funcHigh 7.5 · Oct 26, 2007
• CVE-2007-5684 Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathnHigh 7.5 · Oct 26, 2007
• CVE-2007-5423 tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by crHigh 7.5 · Oct 12, 2007
• CVE-2006-6168 tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separated list of addresseHigh 7.5 · Nov 28, 2006
• CVE-2006-4734 Multiple SQL injection vulnerabilities in tiki-g-admin_processes.php in Tikiwiki 1.9.4 allow remote attackers to execute arbitrary SQL commands via the (1) pid High 7.5 · Sep 13, 2006