Cross-Site Scripting Vulnerability in Tiki by Tiki Wiki
CVE-2024-46878

Currently unrated

Key Information:

Vendor

Tiki Wiki

Status
Tiki
Vendor
CVE Published:
23 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-46878?

A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier, enabling attackers to execute arbitrary JavaScript code. This exploit can lead to unauthorized access to sensitive information or unauthorized actions, posing significant risks to users. It is recommended to upgrade to the latest Tiki version to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-46878-TikiCMS-XSS
Created by ColdFusionX

References

https://tiki.org/tiki-newsletters.php?nlId=8&info=1
https://github.com/ColdFusionX/CVE-2024-46878-TikiCMS-XSS
https://tiki.org/article514-New-Security-Updates-Released...

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.