Mayank

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 24.1 **Description** The issue allows PHP Object Injection in lib/sheet/grid.php due to an unserialize call when the Spreadsheets feature is enabled. **Recommendations** For versions prior to 24.1, update to version 24.1 or later to resolve the issue. As a temporary workaround, consider disabling the Spreadsheets feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 24.2 **Description** The issue allows PHP Object Injection in lib/importer/tikiimporter blog wordpress.php by an admin due to an unserialize call. **Recommendations** For versions prior to 24.2, update to version 24.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 25.0 **Description** The issue allows for CSRF attacks related to `tiki-importer.php` and `tiki-import sheet.php`. **Recommendations** For versions prior to 25.0, update to version 25.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 24.1 **Description** The issue allows PHP Object Injection in lib/structures/structlib.php due to an eval when the feature create webhelp is enabled. **Recommendations** For versions prior to 24.1, update to version 24.1 or later to resolve the issue. As a temporary workaround, consider disabling the feature create webhelp to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Scry Gallery version 1.1 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `p` parameter in index.php. **Recommendations** For Scry Gallery version 1.1, avoid using the `p` parameter in the index.php file until a fix is available. As a temporary workaround, consider restricting access to index.php to minimize the risk of exploitation.