Shimon Silberschlag

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 24.1 **Description** The issue allows PHP Object Injection in lib/sheet/grid.php due to an unserialize call when the Spreadsheets feature is enabled. **Recommendations** For versions prior to 24.1, update to version 24.1 or later to resolve the issue. As a temporary workaround, consider disabling the Spreadsheets feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 24.2 **Description** The issue allows PHP Object Injection in lib/importer/tikiimporter blog wordpress.php by an admin due to an unserialize call. **Recommendations** For versions prior to 24.2, update to version 24.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 25.0 **Description** The issue allows for CSRF attacks related to `tiki-importer.php` and `tiki-import sheet.php`. **Recommendations** For versions prior to 25.0, update to version 25.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tiki versions prior to 24.1 **Description** The issue allows PHP Object Injection in lib/structures/structlib.php due to an eval when the feature create webhelp is enabled. **Recommendations** For versions prior to 24.1, update to version 24.1 or later to resolve the issue. As a temporary workaround, consider disabling the feature create webhelp to minimize the risk of exploitation.