CVE-2012-3996

TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path...

5.0 MediumPublic exploit

TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.

Exploit likelihood

4.59%Up 3.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2012-3996
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-3996
Updated: 2026-11-02

EUVDEUVD-2012-3940 No score

Record: EUVD-2012-3940
Updated: 2026-11-03

GitHub AdvisoriesGHSA-63wj-pwr6-576j No score

TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path...

Record: GHSA-63wj-pwr6-576j
Weakness: CWE-200
Updated: 2026-11-02

Affected products

tiki tikiwiki cms\/groupware

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution	2012-07-04
Exploit-DB	Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution (Metasploit)	2012-07-09

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-3996 is a medium vulnerability (CVSS 5.0) in Tiki Tikiwiki Cms\/groupware, published July 12, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.59%, the 91st percentile. No source names a fixed version.