EUVD-2019-0460

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Simditor 2.3.21 has DOM XSS risk via onload attribute in malformed SVG element.

Reporter	Title	Published	Views	Family All 10
CNVD	Simditor cross-site scripting vulnerability (CNVD-2019-14696)	13 May 201900:00	–	cnvd
CVE	CVE-2018-19048	13 May 201913:13	–	cve
Cvelist	CVE-2018-19048	13 May 201913:13	–	cvelist
Github Security Blog	Cross-Site Scripting in simditor	14 May 201904:01	–	github
NVD	CVE-2018-19048	13 May 201914:29	–	nvd
OSV	GHSA-8V67-X8Q5-3X3G Cross-Site Scripting in simditor	14 May 201904:01	–	osv
Prion	Cross site scripting	13 May 201914:29	–	prion
RedhatCVE	CVE-2018-19048	9 Jan 202612:00	–	redhatcve
Veracode	Cross-site Scripting (XSS)	14 May 201904:54	–	veracode
vulnersOsv	@levi-m/ide-kit (=10.1.0-beta.14), dltsign-mobile (=0.1.0) +6 more potentially affected by CVE-2018-19048 via simditor (>=2.1.14 <=2.3.21)	14 May 201904:01	–	vulnersosv

[
  {
    "enisaIdVendor": [
      {
        "id": "e0767fd9-dec9-3832-a2ac-5d7e28aae33d",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "16e99a6b-fb27-3f06-a8d2-9bcde20124b1",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-19048
github	www.github.com/mycolorway/simditor/commit/ef01a643cbb7f8163535d6bfb71135f80ec6a6fd
github	www.github.com/hkglue/simditor_demo.git
github	www.github.com/hkglue/simditor_dom_xss/blob/master/README.md
github	www.github.com/mycolorway/simditor/releases/tag/v2.3.22
snyk	www.snyk.io/vuln/SNYK-JS-SIMDITOR-174638
npmjs	www.npmjs.com/advisories/884
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

6.2Medium risk

Vulners AI Score6.2

CVSS 36.1

CVSS 24.3

EPSS0.00291