CVE-2014-7236

>= 4.0 and <= 4.0.5

Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code

9.1CRITICAL

CVE-2013-1751

< 5.1.4

TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value

9.8CRITICAL

CVE-2005-3056

all versions

TWiki allows arbitrary shell command execution via the Include function

9.8CRITICAL

CVE-2018-20212

all versions

bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter.

6.1MEDIUM

CVE-2014-9367

all versions

Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to c

CVE-2014-9325

all versions

Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML v

CVE-2014-7237

<= 6.0.0

lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restri

CVE-2012-6330

<= 5.1.2

The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote atta

CVE-2012-0979

all versions

Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organizat

CVE-2011-3010

<= 5.0.1

Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or

CVE-2011-1838

<= 5.0.1

Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to inject arb

CVE-2010-3841

<= 5.0.0

Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitra

CVE-2009-4898

<= 4.3.1

Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbi

CVE-2009-1339

<= 4.3.0

Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authenticati

CVE-2008-5305

<= 4.2.3

Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% varia

CVE-2008-5304

<= 4.2.3

Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via

CVE-2008-4998

all versions

postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. NO

CVE-2008-3195

<= 4.2.2

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped

CVE-2007-5193

all versions

The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area direc

CVE-2007-0669

all versions

Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors relat

CVE-2006-6071

<= 4.0.5

TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a vali

CVE-2006-4294

all versions

Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .

CVE-2006-3819

all versions

Eval injection vulnerability in the configure script in TWiki 4.0.0 through 4.0.4 allows remote attackers to execute arbitrary Per

CVE-2006-3336

all versions

TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with do

CVE-2006-2942

all versions

TWiki 4.0.0, 4.0.1, and 4.0.2 allows remote attackers to gain Twiki administrator privileges via a TWiki.TWikiRegistration form wi

CVE-2006-1387

all versions

TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (i

CVE-2006-1386

all versions

The (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read

CVE-2005-2877

all versions

The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via she

CVE-2004-1037

all versions

The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search s

CVE-2005-0516

all versions

The ImageGalleryPlugin (ImageGalleryPlugin.pm) in Twiki allows remote attackers to execute arbitrary commands via certain commands