Cdxy

The issue allows remote attackers to bypass the XSS filter in Tiki Wiki CMS Groupware. This can be achieved by using padded zero characters. An example of an attack vector is tiki-batch send newsletter.php.

The issue allows remote attackers to bypass the XSS filter. This can be achieved by using an "<svg/onload=" substring instead of an "<svg onload=" substring in the inc/SP/Html/Html.class.php file.

The issue allows remote attackers to bypass CSRF protection by manipulating the HTTP Referer header. This is due to the reliance on a substring check for CSRF protection, which can be exploited by placing the required admin/developer/ URI within a query string in the Referer header. The vulnerability was found in the core/admin/modules/developer/ header.php file and was patched in the core/inc/bigtree/admin.php file.

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the `cat` parameter in the include/functions entries.inc.php file.