CVE-2016-10143

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/96787
https://dev.tiki.org/item6174Permissions Required
https://sourceforge.net/p/tikiwiki/code/60308/Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/96787
https://dev.tiki.org/item6174Permissions Required
https://sourceforge.net/p/tikiwiki/code/60308/Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jan 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-101449.8coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.CVE-2016-101459.8Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.CVE-2016-101467.5Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory cons CVE-2016-101475.5crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system cras CVE-2016-101484.3The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checkin CVE-2016-101497.5XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML CVE-2016-10158.8Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows att CVE-2016-101509.8Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS CVE-2016-101517.0The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment CVE-2016-101529.8The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configurat CVE-2016-101537.8The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows loca CVE-2016-101545.5The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option,