Vulnerabilities > Tiki > Tikiwiki CMS Groupware > High

DATE CVE VULNERABILITY TITLE RISK
2020-12-11 CVE-2020-29254 Cross-Site Request Forgery (CSRF) vulnerability in Tiki Tikiwiki Cms/Groupware 21.2
TikiWiki 21.2 allows templates to be edited without CSRF protection.
network
low complexity
tiki CWE-352
8.8
2019-10-28 CVE-2010-4241 Cross-Site Request Forgery (CSRF) vulnerability in Tiki Tikiwiki Cms/Groupware 5.2
Tiki Wiki CMS Groupware 5.2 has CSRF
network
low complexity
tiki CWE-352
8.8
2019-01-15 CVE-2018-20719 SQL Injection vulnerability in Tiki Tikiwiki Cms/Groupware
In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
network
low complexity
tiki CWE-89
8.8
2017-09-30 CVE-2017-14925 Cross-Site Request Forgery (CSRF) vulnerability in Tiki Tikiwiki Cms/Groupware
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php.
network
low complexity
tiki CWE-352
8.0
2017-09-30 CVE-2017-14924 Cross-Site Request Forgery (CSRF) vulnerability in Tiki Tikiwiki Cms/Groupware
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.
network
low complexity
tiki CWE-352
8.0
2017-01-20 CVE-2016-10143 Information Exposure vulnerability in Tiki Tikiwiki Cms/Groupware 15.2
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.
network
low complexity
tiki CWE-200
7.5