Unscored severity · published Oct 18, 2010
CVE-2010-3841
Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter…
–
CVSS
3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter to the view script or (2) the query string to the login script.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twiki · Twiki
through 5.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +18 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3841
Vendor Advisory
http://secunia.com/advisories/41796
Exploit
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2010-3841
Exploit
http://www.securityfocus.com/bid/44103
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/62557
More from Twiki
9.8
CVE-2013-1751
TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containing Perl backtick characters
9.8
CVE-2005-3056
TWiki allows arbitrary shell command execution via the Include function
9.1
CVE-2014-7236
Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to…
6.1
CVE-2018-20212
bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter
–
CVE-2014-9367
Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cross-site scripting (XSS) attacks via a…