Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote malicious users to conduct cross-site scripting (XSS) attacks via a "'" (single quote) in the scope parameter to do/view/TWiki/WebSearch.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
twiki twiki 6.0.0 |
||
twiki twiki 6.0.1 |