Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-51509

Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored XSS payload in the Name.

Published

2024-10-28T23:15:02.907

Last Modified

2025-06-03T14:57:28.683

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	tiki	tiki	≤ 27.0	Yes

References

https://github.com/r0ck3t1973/xss_payload/issues/10 Issue Tracking, Third Party Advisory ([email protected])
https://security.tiki.org/Disclose-a-Vulnerability Product ([email protected])