An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendorextra/elfinder/.

Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands via (1) the suckurl parameter to tiki-editpage.php or (2) language parameter to tiki-userpreferences.php.

TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386.

TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me" feature. NOTE: some of these details are obtained from third party information.

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sortmode parameter in (1) tiki-usermenu.php, (2) tiki-listfilegallery.php, (3) tiki-directoryranking.php, (4) tiki-browsecategories.php, (5) tiki-index.php, (6) tiki-usertasks.php, (7) tiki-directoryranking.php, (8) tiki-directorysearch.php, (9) tiki-filegalleries.php, (10) tiki-listfaqs.php, (11) tiki-listtrackers.php, (12) tiki-listblogs.php, or via the offset parameter in (13) tiki-usermenu.php, (14) tiki-browsecategories.php, (15) tiki-index.php, (16) tiki-usertasks.php, (17) tiki-listfaqs.php, (18) tiki-listtrackers.php, or (19) tiki-listblogs.php.

Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Name, or (4) Displayed time zone fields in a User Profile, or the (5) Name, (6) Description, (7) URL, or (8) Country fields in a Directory/Add Site operation.

The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary files via the img/wikiup URL.

Multiple SQL injection vulnerabilities in tiki-g-adminprocesses.php in Tikiwiki 1.9.4 allow remote attackers to execute arbitrary SQL commands via the (1) pid and (2) where parameters.

Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.

tiki-viewforumthread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to obtain the installation path via an invalid topicssortmode parameter, possibly related to an SQL injection vulnerability.

Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to gain sensitive information via a direct request to (1) bannerclick.php, (2) categorize.php, (3) tiki-adminincludedirectory.php, (4) tiki-directorysearch.php, which reveal the web server path in an error message.

Directory traversal vulnerability in the map feature (tiki-map.phtml) in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to determine the existence of arbitrary files via .. (dot dot) sequences in the mapfile parameter.

Cross-site scripting (XSS) vulnerability in tiki-viewforumthread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arbitrary web script or HTML via the topicsoffset parameter.

Multiple cross-site scripting (XSS) vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via via the (1) theme parameter to tiki-switchtheme.php, (2) find and priority parameters to messu-mailbox.php, (3) flag, priority, flagval, sortmode, or find parameters to messu-read.php, (4) articleId parameter to tiki-readarticle.php, (5) parentId parameter to tiki-browsecategories.php, (6) commentsthreshold parameter to tiki-index.php (7) articleId parameter to tiki-printarticle.php, (8) galleryId parameter to tiki-listfilegallery.php, (9) galleryId parameter to tiki-uploadfile.php, (10) faqId parameter to tiki-viewfaq.php, (11) chartId parameter to tiki-viewchart.php, or (12) surveyId parameter to tiki-surveystatssurvey.php.

Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "<scr<script>ipt>" in (1) offset and (2) days parameters in (a) tiki-lastchanges.php, the (3) find and (4) offset parameters in (b) tiki-orphanpages.php, the (5) offset and (6) initial parameters in (c) tiki-listpages.php, and (7) an unspecified field in (d) tiki-remindpassword.php; and allow remote authenticated users with admin privileges to inject arbitrary web script or HTML via (8) an unspecified field in a metatags action in (e) tiki-admin.php, the (9) offset parameter in (f) tiki-adminrssmodules.php, the (10) offset and (11) max parameters in (g) tiki-syslog.php, the (12) numrows parameter in (h) tiki-adminusers.php, (13) an unspecified field in (i) tiki-adminusers.php, (14) an unspecified field in (j) tiki-adminhotwords.php, unspecified fields in (15) "Assign new module" and (16) "Create new user module" in (k) tiki-adminmodules.php, (17) an unspecified field in "Add notification" in (l) tiki-adminnotifications.php, (18) the offset parameter in (m) tiki-adminnotifications.php, the (19) Name and (20) Dsn fields in (o) tiki-admindsn.php, the (21) offset parameter in (p) tiki-admincontenttemplates.php, (22) an unspecified field in "Create new template" in (q) tiki-admincontenttemplates.php, and the (23) offset parameter in (r) tiki-adminchat.php.