CVE-2018-20719

HIGH

TikiWiki CMS/Groupware < 17.2 - SQL Injection via User Tasks Show History Parameter

Title source: llm

In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 8.8

EPSS 0.0100

EPSS Percentile 58.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89

Status published

Products (1)

tiki/tikiwiki_cms\/groupware < 17.2

Published Jan 15, 2019

Tracked Since Feb 18, 2026