CVE-2016-9889
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tiki Wiki CMS是Tiki软件社区的一套开源的内容管理和门户应用程序，它可用于创建Web应用程序、门户网站、企业内部网、外联网等。 Tiki Wiki CMS中带有‘geo_zoomlevel_to_found_location’参数的表格中存在跨站脚本漏洞，该漏洞源于程序没有过滤输入。远程攻击者可利用该漏洞注入任意Web脚本或HTML。以下版本受到影响：Tiki Wiki CMS 12.10 LTS之前的12.x版本，15.3 LTS之前的15.x版本，16.1之前的16.x版本。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2016-9889
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Tiki Wiki CMS 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tiki Wiki CMS是Tiki软件社区的一套开源的内容管理和门户应用程序，它可用于创建Web应用程序、门户网站、企业内部网、外联网等。 Tiki Wiki CMS中带有‘geo_zoomlevel_to_found_location’参数的表格中存在跨站脚本漏洞，该漏洞源于程序没有过滤输入。远程攻击者可利用该漏洞注入任意Web脚本或HTML。以下版本受到影响：Tiki Wiki CMS 12.10 LTS之前的12.x版本，15.3 LTS之前的15.x版本，16.1之前的16.x版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2016-9889
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-9889
请登录查看更多情报信息。
Vendor Advisories for CVE-2016-9889 (2)
Other References for CVE-2016-9889 (1)
Same Patch Batch · n/a · 2016-12-23 · 27 CVEs total
| CVE-2016-6659 | Pivotal Cloud Foundry和UAA 安全漏洞 | |
| CVE-2016-9561 | FFmpeg 资源管理错误漏洞 | |
| CVE-2016-9154 | Desigo PX Web Modules 安全漏洞 | |
| CVE-2016-8595 | FFmpeg 输入验证漏洞 | |
| CVE-2016-7905 | FFmpeg 安全漏洞 | |
| CVE-2016-7785 | FFmpeg 输入验证漏洞 | |
| CVE-2016-7562 | FFmpeg 缓冲区错误漏洞 | |
| CVE-2016-7555 | FFmpeg 信息泄露漏洞 | |
| CVE-2016-7502 | FFmpeg 安全漏洞 | |
| CVE-2016-7450 | FFmpeg 安全漏洞 | |
| CVE-2016-7122 | FFmpeg 资源管理错误漏洞 | |
| CVE-2016-6881 | FFmpeg 资源管理错误漏洞 | |
| CVE-2016-6671 | FFmpeg 缓冲区错误漏洞 | |
| CVE-2016-2312 | KDE Plasma-workspace和kscreenlocker 安全漏洞 | |
| CVE-2016-6910 | Samsung Galaxy S6 Edge Android 信息泄露漏洞 | |
| CVE-2016-9923 | QEMU 安全漏洞 | |
| CVE-2016-9921 | QEMU 数字错误漏洞 | |
| CVE-2016-9912 | QEMU 安全漏洞 | |
| CVE-2016-9911 | QEMU 安全漏洞 | |
| CVE-2016-9908 | QEMU 信息泄露漏洞 |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2016-9889
No comments yet