CVE-2004-1925

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow...

7.5 HighPublic exploit

CVE-2004-1925 is a high vulnerability (CVSS 7.5) in Tiki Tikiwiki Cms\/groupware, published April 12, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. No source names a fixed version.

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode parameter in (1) tiki-usermenu.php, (2) tiki-list_file_gallery.php, (3) tiki-directory_ranking.php, (4) tiki-browse_categories.php, (5) tiki-index.php, (6) tiki-user_tasks.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-file_galleries.php, (10) tiki-list_faqs.php, (11) tiki-list_trackers.php, (12) tiki-list_blogs.php, or via the offset parameter in (13) tiki-usermenu.php, (14) tiki-browse_categories.php, (15) tiki-index.php, (16) tiki-user_tasks.php, (17) tiki-list_faqs.php, (18) tiki-list_trackers.php, or (19) tiki-list_blogs.php.

Exploit likelihood

1.21%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2004-1925
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-1925
Updated: 2026-11-02

EUVDEUVD-2004-1918 No score

Record: EUVD-2004-1918
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4hqx-53cj-v46r No score

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow...

Record: GHSA-4hqx-53cj-v46r
Weakness: CWE-89
Updated: 2026-11-02

Affected products

tiki tikiwiki cms\/groupware

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	TikiWiki Project 1.8 - 'tiki-usermenu.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-list_file_gallery.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-directory_ranking.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-browse_categories.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-index.php?comments_offset & offset' SQL Injections	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-user_tasks.php?offset & sort_mode' SQL Injections	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-directory_search.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-file_galleries.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-list_faqs.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-list_trackers.php?sort_mode' SQL Injection	2004-04-12

Show 6 moreShow less

Public exploits
Source	Link	Date
Exploit-DB	TikiWiki Project 1.8 - 'tiki-list_blogs.php?sort_mode' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-usermenu.php?offset' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-list_faqs.php?offset' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-list_trackers.php?offset' SQL Injection	2004-04-12
Exploit-DB	TikiWiki Project 1.8 - 'tiki-list_blogs.php?offset' SQL Injection	2004-04-12
Exploit-DB	TikiWiki < 1.8.1 - Multiple Vulnerabilities	2004-04-11

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

Exploit likelihood

What each source reports

Affected products

Public exploits

History

References