VDB
CVE-2009-1204
CVE-2009-1204
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file_gallery.php, (3) tiki-listpages.php, and (4) tiki-orphan_pages.php.
EPSS 4.54% · 91.4th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
4.54%
91.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | * |
| tiki | tikiwiki_cms\/groupware | 2.2 |
Timeline
- Mar 12, 2009 PoC Published
- Apr 1, 2009 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
References
- http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=2359&trackerId=5&show=view&reloff=3&cant=1229&status=o&trackerId=5&sort_mode=created_desc url
- 34107 vdb
- 34105 vdb
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/2.0/changelog.txt?view=markup url
- 34106 vdb
- http://info.tikiwiki.org/tiki-read_article.php?articleId=51 url
- 34108 vdb
- 20090312 TikiWiki 2.2 XSS Vulnerability in URI mailing-list
- 34273 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2009-1204 advisory