The Calendar component in Tiki 17.1 allows HTML injection.
- https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html
No PoCs found on GitHub currently.