Drupal 7 CKEditor XSS

CKEditor 4.14.0 through 4.16.x before 4.16.1 contains a reflected cross-site scripting caused by mishandling in comments, letting remote attackers inject executable JavaScript code, exploit requires victim to view malicious content. id: CVE-2021-33829 info: name: Drupal 7 CKEditor XSS author:...

PT-2026-137305

The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML...

PT-2026-137295

This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting XSS vulnerability...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2021. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If successfull...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion 2018 RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2018. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If...

CVE-2024-24816

CVE-2024-24816 CKEditor 4 XSS This issue was caused by a lack of sanitization of the data passed to "preview" feature. This problem has been fixed in CKEditor 4 at version 4.24.0-lts. Affected versions 4.24.0-lts Advisory Update CKEditor 4 to version 4.24.0-lts or newer. References...

CVE-2018-15961

CVE-2018-15961 Unrestricted file upload in Adobe ColdFusion POST /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 Host: coldfusion:port User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/62.0.3202.9 Safari/537.36 Content-Type:...

CLEANSTART-2024-VX73174 CKEditor 4

Security vulnerability affects the otrs package. CKEditor 4...

CVE-2024-37888

CVE-2024-37888 This repository documents vulnerability details and exploit for CVE-2024-37888 discovered and reported by Anurag Mondal 7Ragnarok7 on May 21st, 2024. Metrics CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS: 6.1 MEDIUM Vulnerability...

CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload

CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload POC of DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite I'm a simple man, I see cvss:10/10 I go in xD I saw this new CVE CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content...

CVE-2023-46694

CVE-2023-46694 Discovered by: Federico Zambito with Innovery Summary Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, resulting in remote code execution. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckedito...

drupal-ckeditor-fileisimage

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · drupal-ckeditor-fileisimage Write-up: https://abraxaslabs.tech/research/drupal-ckeditor-fileisimage drupal-ckeditor-fileisimage Class: Unrestricted upload / stored XSS Reach: Remote Drupal core 11.4.8 61044508 - Drupa...

CKEditor 45.x < 47.7.4 / 48.x < 48.5.1 XSS

The version of CKEditor included on the remote web host is 45.x prior to 47.7.4, or 48.x prior to 48.5.1. It is, therefore, affected by a cross-site scripting XSS vulnerability. The CKEditor 5 engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while...

CKEditor: Cross-site Scripting (XSS) In The Engine Package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...

CKEditor: Cross-site Scripting (XSS) In The Engine Package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the "es-toolkit" library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

Linux Distros Unpatched Vulnerability : CVE-2026-116687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-sit...

Linux Distros Unpatched Vulnerability : CVE-2026-116688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit versio...

GHSA-V6MG-96C6-GMPQ CKEditor: Cross-site scripting (XSS) in the engine package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +1612 more potentially affected by CVE-2026-116687 via @ckeditor/ckeditor5-engine (>=29.2.0, <=47.7.3)

@ckeditor/ckeditor5-engine NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =29.2.0, =2.0.0, =30.0.0, =0.7.0, =1.0.0, =0.0.3, =0.0.6, =1.3.0, =1.5.3 and more Source cves: CVE-2026-116687 Source advisory: GHSA-V6MG-96C6-GMPQ...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +1612 more potentially affected by CVE-2026-116687 via @ckeditor/ckeditor5-engine (>=29.2.0, <=47.7.3)

@ckeditor/ckeditor5-engine NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =29.2.0, =2.0.0, =30.0.0, =0.7.0, =1.0.0, =0.0.3, =0.0.6, =1.3.0, =1.5.3 and more Source cves: CVE-2026-116687 Source advisory: OSV:GHSA-V6MG-96C6-GMPQ...