CVE-2016-9889
UnknownEPSS 1.25%
Last modified
CVE-2016-9889 is a vulnerability of currently unknown severity. Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.. EPSS estimates a 1.25% chance of exploitation in the next 30 days.
Description
Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tiki | Tikiwiki Cms\/Groupware | 12.0 |
| Tiki | Tikiwiki Cms\/Groupware | 12.1 |
| Tiki | Tikiwiki Cms\/Groupware | 12.2 |
| Tiki | Tikiwiki Cms\/Groupware | 12.3 |
| Tiki | Tikiwiki Cms\/Groupware | 12.4 |
| Tiki | Tikiwiki Cms\/Groupware | 12.5 |
| Tiki | Tikiwiki Cms\/Groupware | 12.6 |
| Tiki | Tikiwiki Cms\/Groupware | 12.7 |
| Tiki | Tikiwiki Cms\/Groupware | 12.8 |
| Tiki | Tikiwiki Cms\/Groupware | 12.9 |
| Tiki | Tikiwiki Cms\/Groupware | 15.0 |
| Tiki | Tikiwiki Cms\/Groupware | 15.1 |
| Tiki | Tikiwiki Cms\/Groupware | 15.2 |
| Tiki | Tikiwiki Cms\/Groupware | 16.0 |
References
- http://www.securityfocus.com/bid/95083Third Party Advisory, VDB Entry
- https://tiki.org/article443-Security-update-Tiki-16-1-Tiki-15-3-and-Tiki-12-10-releasedRelease Notes, Vendor Advisory
- http://www.securityfocus.com/bid/95083Third Party Advisory, VDB Entry
- https://tiki.org/article443-Security-update-Tiki-16-1-Tiki-15-3-and-Tiki-12-10-releasedRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-9889?
Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.
How severe is CVE-2016-9889?
Severity scoring for CVE-2016-9889 is pending analysis. The EPSS model estimates a 1.25% probability of exploitation in the next 30 days.
How do I fix CVE-2016-9889?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-9882An issue was discovered in Cloud Foundry Foundation cf-relea…7.5
- CVE-2016-9883Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2016-9884Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2016-9885An issue was discovered in Pivotal GemFire for PCF 1.6.x ver…
- CVE-2016-9886Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2016-9888An error within the "tar_directory_for_file()" function (gsf…
- CVE-2016-9891Cross-site scripting (XSS) vulnerability in admin/media.php …
- CVE-2016-9892The esets_daemon service in ESET Endpoint Antivirus for macO…
- CVE-2016-9893Memory safety bugs were reported in Thunderbird 45.5. Some o…
- CVE-2016-9894A buffer overflow in SkiaGl caused when a GrGLBuffer is trun…
- CVE-2016-9895Event handlers on "marquee" elements were executed despite a…
- CVE-2016-9896Use-after-free while manipulating the "navigator" object wit…
Are you affected by CVE-2016-9889?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST