Phpwiki is a lightweight wiki engine deployed in web environments where its vulnerability footprint concentrates on a single product line. Observed vulnerabilities in this vendor reflect the general input-handling and access-control surface inherent to collaborative web applications; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpwiki over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-5519HIGH The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. | Sep 11, 2014 | 7.5 | 77 | NO | YES |
CVE-2017-7981HIGH Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used wit | Apr 29, 2017 | 8.8 | 48 | NO | YES |
CVE-2002-1070HIGH Cross-site scripting vulnerability in PHPWiki Postnuke wiki module allows remote attackers to execute script as other PHPWiki users via the pagename parameter. | Oct 4, 2002 | 7.5 | 29 | NO | YES |
CVE-2007-2025HIGH Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extensi | Apr 13, 2007 | 7.5 | 26 | NO | NO |
CVE-2007-3193HIGH lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty | Jun 12, 2007 | 10.0 | 25 | NO | NO |
CVE-2007-2024MEDIUM Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a (1) php3, (2) php | Apr 13, 2007 | 6.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpwiki.
Media articles that mention a CVE ID that affects a product developed by Phpwiki — matched by CVE ID, not by vendor name.