GCVE - cpe:2.3:a:twiki:twiki:2000-12-01:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:twiki:twiki:2000-12-01:*:*:*:*:*:*:*

part: a version: 2000-12-01 update: *

Vendor	Twiki (`3a715e6b-0582-5b8f-8e4f-000ddecce81e`)
Product	Twiki (`3cf8f6ac-b426-5e8a-bd57-f1b5cdff3037`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:rpm/opensuse/twiki`	purl2cpe	2026-06-01 10:12:44.323807
`pkg:sourceforge/twiki`	purl2cpe	2026-06-01 10:12:44.323809

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-3841`	vulnerable	2026-06-08 04:55:17.508720	Details available Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter to the view script or (2) the query string to the login script. Published: 2010-10-18T16:00:00.000Z Updated: 2024-08-07T03:26:12.232Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/62557 http://secunia.com/advisories/41796 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2010-3841 http://www.securityfocus.com/bid/44103	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-5304`	vulnerable	2026-06-08 04:50:50.727862	Details available Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable. Published: 2008-12-10T00:00:00.000Z Updated: 2024-08-07T10:49:12.286Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/32669 http://www.vupen.com/english/advisories/2008/3381 http://securitytracker.com/id?1021351 https://exchange.xforce.ibmcloud.com/vulnerabilities/47122 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-3336`	vulnerable	2026-06-08 04:49:08.943046	Details available TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory. Published: 2006-07-05T20:00:00.000Z Updated: 2024-08-07T18:23:21.162Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2006/2677 http://secunia.com/advisories/20992 http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads http://www.securityfocus.com/bid/18854 http://securitytracker.com/id?1016458	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-2877`	vulnerable	2026-06-08 04:48:30.814785	Details available The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers. Published: 2005-09-16T04:00:00.000Z Updated: 2024-08-07T22:53:29.778Z Open on db.gcve.eu Reference links http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev http://marc.info/?l=bugtraq&m=112680475417550&w=2 http://www.kb.cert.org/vuls/id/757181 http://www.securityfocus.com/bid/14834	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Twiki

Notes

PURL mappings

Vulnerability references

Contribute