CVE-2009-1204

Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file_gallery.php, (3) tiki-listpages.php, and (4) tiki-orphan_pages.php.

• CWE-79

• http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=2359&trackerId=5&show=view&reloff=3&cant=1229&status=o&trackerId=5&sort_mode=created_descExploit, Vendor Advisory
• http://info.tikiwiki.org/tiki-read_article.php?articleId=51Patch
• http://secunia.com/advisories/34273Vendor Advisory
• http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/2.0/changelog.txt?view=markupPatch
• http://www.securityfocus.com/archive/1/501702/100/0/threaded
• http://www.securityfocus.com/bid/34105Exploit
• http://www.securityfocus.com/bid/34106Exploit
• http://www.securityfocus.com/bid/34107Exploit
• http://www.securityfocus.com/bid/34108Exploit
• http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=2359&trackerId=5&show=view&reloff=3&cant=1229&status=o&trackerId=5&sort_mode=created_descExploit, Vendor Advisory
• http://info.tikiwiki.org/tiki-read_article.php?articleId=51Patch
• http://secunia.com/advisories/34273Vendor Advisory
• http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/2.0/changelog.txt?view=markupPatch
• http://www.securityfocus.com/archive/1/501702/100/0/threaded
• http://www.securityfocus.com/bid/34105Exploit
• http://www.securityfocus.com/bid/34106Exploit
• http://www.securityfocus.com/bid/34107Exploit
• http://www.securityfocus.com/bid/34108Exploit

Published

Apr 1, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1196The directory-services functionality in the scheduler in CUP…
• CVE-2009-1197Apache jUDDI before 2.0 allows attackers to spoof entries in…
• CVE-2009-1198Cross-site scripting (XSS) vulnerability in Apache jUDDI bef…
• CVE-2009-1201Eval injection vulnerability in the csco_wrap_js function in…
• CVE-2009-1202WebVPN on the Cisco Adaptive Security Appliances (ASA) devic…
• CVE-2009-1203WebVPN on the Cisco Adaptive Security Appliances (ASA) devic…
• CVE-2009-1205Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-1206Unspecified vulnerability in futomi's CGI Cafe Access Analyz…
• CVE-2009-1207Race condition in the dircmp script in Sun Solaris 8 through…
• CVE-2009-1208SQL injection vulnerability in auth2db 0.2.5, and possibly o…
• CVE-2009-1209Stack-based buffer overflow in W3C Amaya Web Browser 11.1 al…
• CVE-2009-1210Format string vulnerability in the PROFINET/DCP (PN-DCP) dis…