CVE-2011-3010

CVE-2011-3010 describes multiple cross-site scripting (XSS) vulnerabilities affecting TWiki versions prior to 5.1.0. These flaws allow remote attackers to inject arbitrary web script or HTML through the 'newtopic' parameter in the WebCreateNewTopic action or via the query string to SlideShow.pm in the SlideShowPlugin. With a CVSS score of 4.3 (medium severity), successful exploitation requires medium attack complexity and could lead to information disclosure or defacement, though it does not impact confidentiality or availability. While not listed in CISA's KEV catalog, exploit code for both XSS vectors is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.