Secunia Security Advisory – Moritz Naumann has reported a vulnerability in TikiWiki, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the topics_offset parameter in tiki-view_forum_thread.php isn’t properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site. It is also possible to disclose the full path to tiki-view_forum_thread.php by accessing it with an invalid topics_sort_mode parameter. The vulnerability has been reported in versions 1.9.x through 1.9.2. Other versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/41458/sa17521.txt
Source: https://packetstormsecurity.com/files/41458/Secunia-Security-Advisory-17521.html