CVE-2006-2635Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary…
- 4.3MediumCVSS base score
- 3.8%Exploitation in 30 daysEPSS · top 9.8% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 1Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "<scr<script>ipt>" in (1) offset and (2) days parameters in (a) tiki-lastchanges.php, the (3) find and (4) offset parameters in (b) tiki-orphan_pages.php, the (5) offset and (6) initial parameters in (c) tiki-listpages.php, and (7) an unspecified field in (d) tiki-remind_password.php; and allow remote authenticated users with admin privileges to inject arbitrary web script or HTML via (8) an unspecified field in a metatags action in (e) tiki-admin.php, the (9) offset parameter in (f) tiki-admin_rssmodules.php, the (10) offset and (11) max parameters in (g) tiki-syslog.php, the (12) numrows parameter in (h) tiki-adminusers.php, (13) an unspecified field in (i) tiki-adminusers.php, (14) an unspecified field in (j) tiki-admin_hotwords.php, unspecified fields in (15) "Assign new module" and (16) "Create new user module" in (k) tiki-admin_modules.php, (17) an unspecified field in "Add notification" in (l) tiki-admin_notifications.php, (18) the offset parameter in (m) tiki-admin_notifications.php, the (19) Name and (20) Dsn fields in (o) tiki-admin_dsn.php, the (21) offset parameter in (p) tiki-admin_content_templates.php, (22) an unspecified field in "Create new template" in (q) tiki-admin_content_templates.php, and the (23) offset parameter in (r) tiki-admin_chat.php.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list an Exploit-DB entry for it.
Show the exploits1
Exploit-DB1 entry
- TikiWiki 1.9 - 'tiki-lastchanges.php' Multiple Cross-Site Scripting Vulnerabilities (Exploit-DB entry) (opens in a new tab)
EDB-ID 27917webapps, phppublished 29 May 2006Verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By mitre
Published
- 18 years later
· 18 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
- EPSS (exploitation in 30 days)
- 3.8% · top 9.8% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Affected products
n/a
- affected n/a
References
References22
- 18143 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- http://tikiwiki.org/tiki-read_article.php?articleId=131 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 26050 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26059 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26061 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26053 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26060 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26056 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26054 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26051 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- ADV-2006-2024 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 26062 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 976 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
- 26057 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 20334 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 26052 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26058 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26048 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 20060525 Multiple XSS Vulnerabilities in Tikiwiki 1.9.x (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 20060608 Tikiwiki 1.9.3.2 security release (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 26049 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 26055 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2006-2634 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2006-2635)Record last updated .