GCVE - cpe:2.3:a:twiki:twiki:2001-09-01:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:twiki:twiki:2001-09-01:*:*:*:*:*:*:*

part: a version: 2001-09-01 update: *

Vendor	Twiki (`3a715e6b-0582-5b8f-8e4f-000ddecce81e`)
Product	Twiki (`3cf8f6ac-b426-5e8a-bd57-f1b5cdff3037`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:rpm/opensuse/twiki`	purl2cpe	2026-06-01 10:12:44.324913
`pkg:sourceforge/twiki`	purl2cpe	2026-06-01 10:12:44.324915

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-3841`	vulnerable	2026-06-08 04:55:17.509274	Details available Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter to the view script or (2) the query string to the login script. Published: 2010-10-18T16:00:00.000Z Updated: 2024-08-07T03:26:12.232Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/62557 http://secunia.com/advisories/41796 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2010-3841 http://www.securityfocus.com/bid/44103	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-5304`	vulnerable	2026-06-08 04:50:50.728334	Details available Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable. Published: 2008-12-10T00:00:00.000Z Updated: 2024-08-07T10:49:12.286Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/32669 http://www.vupen.com/english/advisories/2008/3381 http://securitytracker.com/id?1021351 https://exchange.xforce.ibmcloud.com/vulnerabilities/47122 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-3336`	vulnerable	2026-06-08 04:49:08.943536	Details available TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory. Published: 2006-07-05T20:00:00.000Z Updated: 2024-08-07T18:23:21.162Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2006/2677 http://secunia.com/advisories/20992 http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads http://www.securityfocus.com/bid/18854 http://securitytracker.com/id?1016458	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-1387`	vulnerable	2026-06-08 04:48:57.077548	Details available TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (infinite recursion leading to CPU and memory consumption) via INCLUDE by URL statements that form a loop, such as a page that includes itself. Published: 2006-03-26T22:00:00.000Z Updated: 2024-08-07T17:12:20.925Z Open on db.gcve.eu Reference links http://secunia.com/advisories/19410 https://exchange.xforce.ibmcloud.com/vulnerabilities/25445 http://twiki.org/cgi-bin/view/Codev/SecurityAdvisoryDosAttackWithInclude http://www.vupen.com/english/advisories/2006/1116 http://www.securityfocus.com/bid/17267	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Twiki

Notes

PURL mappings

Vulnerability references

Contribute