PhpWiki is a collaborative wiki engine implemented in PHP whose vulnerability profile centers on code-injection and OS-command-injection weaknesses in the core application. These input-handling flaws reflect the parser and shell-interaction demands inherent to a wiki platform that processes user-contributed markup and executes system operations; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpwiki Project over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-5519HIGH The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. | Sep 11, 2014 | 7.5 | 77 | NO | YES |
CVE-2017-7981HIGH Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used wit | Apr 29, 2017 | 8.8 | 48 | NO | YES |
CVE-2002-1070HIGH Cross-site scripting vulnerability in PHPWiki Postnuke wiki module allows remote attackers to execute script as other PHPWiki users via the pagename parameter. | Oct 4, 2002 | 7.5 | 29 | NO | YES |
CVE-2007-2025HIGH Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extensi | Apr 13, 2007 | 7.5 | 26 | NO | NO |
CVE-2007-3193HIGH lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty | Jun 12, 2007 | 10.0 | 25 | NO | NO |
CVE-2007-2024MEDIUM Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a (1) php3, (2) php | Apr 13, 2007 | 6.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpwiki Project.
Media articles that mention a CVE ID that affects a product developed by Phpwiki Project — matched by CVE ID, not by vendor name.