CVE-2025-25062

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an...

PT-2025-5615 · Unknown · Ckeditor 5 +1

Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.28.x through 1.28.4 Backdrop CMS versions 1.29.x through 1.29.2 Description: A cross-site scripting XSS issue was discovered in Backdrop CMS when using the CKEditor 5 rich text editor. The issue arises because the syst...

Security Bulletin: IBM Engineering Requirements Management DOORS Next uses a CKEditor version affected by multiple vulnerabilities

Summary IBM Engineering Requirements Management DOORS Next uses a CKEditor version vulnerable to CVE-2021-33829 'Cross-site Scripting', CVE-2020-27193 'Cross-site Scripting', CVE-2021-26272 ReDoS, CVE-2021-41164 'Cross-site Scripting', CVE-2021-26271 ReDoS, CVE-2021-37695 'Cross-site Scripting',...

PT-2025-4772 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 15.10.2 XWiki Platform versions prior to 16.4.1 XWiki Platform versions prior to 16.6.0-rc-1 Description: A user with only edit right can join a realtime editing session where others have script or programming...

CVE-2024-13245

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting XSS.This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1...

CVE-2024-13245

The CVE-2024-13245 issue affects Drupal CKEditor 4 LTS - WYSIWYG HTML editor (CKEditor 4 LTS) where an improper neutralization of input during web page generation creates a Cross-Site Scripting (XSS) vulnerability. Affected version range is 1.0.0 up to (before) 1.0.1. Several connected sources co...

CVE-2024-13245 CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting XSS.This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1...

CVE-2024-13245 CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting XSS.This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1...

CVE-2024-13245 CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting XSS.This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1...

PT-2025-2084 · Unknown · Ckeditor 4 Lts

Name of the Vulnerable Software and Affected Versions: CKEditor 4 LTS - WYSIWYG HTML editor versions 1.0.0 through 1.0.0 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. This enables attackers to inject malicious...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal CKEditor 4 LTS - WYSIWYG HTML editor versions 1.0.0 to 1.0.1, which originates from improper input neutralization during web page generation, resulti...

openSUSE Security Advisory (openSUSE-SU-2025:0008-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15 Security Update : python-django-ckeditor (openSUSE-SU-2025:0008-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2025:0008-1 advisory. - Update to 6.7.2 Deprecated the package. Added a new ckeditor/fixups.js script which disables the version check again if something slips through by...

Cross-site Scripting (XSS)

Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to Cross-site Scripting XSS in ckeditor5.js, which does not sufficiently isolate ckeditor rich text objects. A user with the ability to input long tex...

OPENSUSE-SU-2025:0008-1 Security update for python-django-ckeditor

This update for python-django-ckeditor fixes the following issues: - Update to 6.7.2 Deprecated the package. Added a new ckeditor/fixups.js script which disables the version check again if something slips through by accident and which disables the behavior where CKEditor 4 would automatically...

Security update for python-django-ckeditor (moderate)

openSUSE Security Update: Security update for python-django-ckeditor Announcement ID: openSUSE-SU-2025:0008-1 Rating: moderate References: 1219720 Cross-References: CVE-2024-24815 Affected Products: openSUSE Backports SLE-15-SP5 An update that fixes one vulnerability is now available. Description...

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Overview aptrs is an Automated Penetration Testing Reporting System Affected versions of this package are vulnerable to Improper Neutralization of Server-Side Includes SSI Within a Web Page in the web application's handling of user-supplied input in the ckeditor fields that are passed directly to...

PT-2024-36805

Name of the Vulnerable Software and Affected Versions APTRS version 1.0 Description The issue is related to the web application's handling of user-supplied input that is incorporated into a Jinja2 template. When user input is improperly sanitized or validated, an attacker can inject Jinja2 syntax...

OPENSUSE-SU-2024:14557-1 python310-django-ckeditor-6.7.2-1.1 on GA media

These are all security issues fixed in the python310-django-ckeditor-6.7.2-1.1 package on the GA media of openSUSE Tumbleweed...

Drupal core vulnerable to improper error handling

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-defau...