{"api_version":"1","generated_at":"2026-07-23T06:21:55+00:00","cve":"CVE-2010-4886","urls":{"html":"https://cve.report/CVE-2010-4886","api":"https://cve.report/api/cve/CVE-2010-4886.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2010-4886","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-4886"},"summary":{"title":"CVE-2010-4886","description":"Cross-site scripting (XSS) vulnerability in the \"official twitter tweet button for your page\" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2011-10-07 10:55:09","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/41268","name":"http://secunia.com/advisories/41268","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"TYPO3 The official twitter tweet button for your page Extension Cross-Site Scripting Vulnerability - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://typo3.org/extensions/repository/view/tweetbutton/1.0.5/","name":"http://typo3.org/extensions/repository/view/tweetbutton/1.0.5/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Page not found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://www.securityfocus.com/bid/42941","name":"http://www.securityfocus.com/bid/42941","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"TYPO3 The official twitter tweet button Unspecified Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/","name":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"TYPO3 - the Enterprise Open Source CMS: TYPO3 Security Bulletin TYPO3-SA-2010-018: Multiple vulnerabilities in third-party extensions","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-4886","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4886","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2010","cve_id":"4886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"peter_proell","cpe5":"tweetbutton","cpe6":"1.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"4886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"peter_proell","cpe5":"tweetbutton","cpe6":"1.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"4886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"peter_proell","cpe5":"tweetbutton","cpe6":"1.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"4886","vulnerable":"1","versionEndIncluding":"1.0.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"peter_proell","cpe5":"tweetbutton","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"4886","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"typo3","cpe5":"typo3","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T04:02:30.487Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"42941","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/42941"},{"name":"41268","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/41268"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://typo3.org/extensions/repository/view/tweetbutton/1.0.5/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the \"official twitter tweet button for your page\" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2011-10-07T10:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"42941","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/42941"},{"name":"41268","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/41268"},{"tags":["x_refsource_CONFIRM"],"url":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/"},{"tags":["x_refsource_CONFIRM"],"url":"http://typo3.org/extensions/repository/view/tweetbutton/1.0.5/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2010-4886","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the \"official twitter tweet button for your page\" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"42941","refsource":"BID","url":"http://www.securityfocus.com/bid/42941"},{"name":"41268","refsource":"SECUNIA","url":"http://secunia.com/advisories/41268"},{"name":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/","refsource":"CONFIRM","url":"http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/"},{"name":"http://typo3.org/extensions/repository/view/tweetbutton/1.0.5/","refsource":"CONFIRM","url":"http://typo3.org/extensions/repository/view/tweetbutton/1.0.5/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2010-4886","datePublished":"2011-10-07T10:00:00.000Z","dateReserved":"2011-10-07T00:00:00.000Z","dateUpdated":"2024-09-17T04:09:58.649Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-10-07 10:55:09","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:peter_proell:tweetbutton:*:*:*:*:*:*:*:*","versionEndIncluding":"1.0.4","matchCriteriaId":"993DDE43-A1A5-468A-85E7-65D76BB15FAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:peter_proell:tweetbutton:1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"4B24728A-A7F8-4ABF-A176-B2B7526968DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:peter_proell:tweetbutton:1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C1270123-CC33-4FBA-8DEA-2C2262660D19"},{"vulnerable":true,"criteria":"cpe:2.3:a:peter_proell:tweetbutton:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"7BD8C425-0BCF-4143-BB0C-FAFAF4447B7C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","matchCriteriaId":"5F1C59B0-CDF2-4F9A-88C7-61E8F18590DB"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2010","CveId":"4886","Ordinal":"1","Title":"CVE-2010-4886","CVE":"CVE-2010-4886","Year":"2010"},"notes":[{"CveYear":"2010","CveId":"4886","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the \"official twitter tweet button for your page\" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","Type":"Description","Title":"CVE-2010-4886"},{"CveYear":"2010","CveId":"4886","Ordinal":"2","NoteData":"2011-10-07","Type":"Other","Title":"Published"}]}}}