CVE-2007-5683

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-26 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to the password reminder page (tiki-remind_password.php), (2) IMG tags in wiki pages, and (3) the local_php parameter to db/tiki-db.php.

Affected products

Tiki: through 1.9.8.1; 1.6.1, 1.9.0, 1.9.0-rc1, 1.9.0-rc2, 1.9.0-rc3, 1.9.1 (+7)

References

http://info.tikiwiki.org/tiki-read_article.php?articleId=15
http://www.securityfocus.com/archive/1/482801/30/0/threaded
http://info.tikiwiki.org/tiki-read_article.php?articleId=15
http://www.securityfocus.com/archive/1/482801/30/0/threaded

Get alerted when CVE-2007-5683 or the next vulnerability affects your stack