1119 matches found
CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload
CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload POC of DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite I'm a simple man, I see cvss:10/10 I go in xD I saw this new CVE CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content...
CVE-2023-46694
CVE-2023-46694 Discovered by: Federico Zambito with Innovery Summary Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, resulting in remote code execution. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckedito...
CVE-2024-24816
CVE-2024-24816 CKEditor 4 XSS This issue was caused by a lack of sanitization of the data passed to "preview" feature. This problem has been fixed in CKEditor 4 at version 4.24.0-lts. Affected versions 4.24.0-lts Advisory Update CKEditor 4 to version 4.24.0-lts or newer. References...
CVE-2023-4771
CKEditor cross-site scripting vulnerability in AJAX sample CVE-2023-4771 PoC CKEditor 4 Cross-site scripting XSS vulnerability in AJAX sample This document describes how to perform an XSS vulnerability CVE-2023-4771 using CKEditor. Make sure the following is done with great caution to follow...
CVE-2018-15961
CVE-2018-15961 - Adobe ColdFusion RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2021. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If successfull...
Drupal 7 CKEditor XSS
CKEditor 4.14.0 through 4.16.x before 4.16.1 contains a reflected cross-site scripting caused by mishandling in comments, letting remote attackers inject executable JavaScript code, exploit requires victim to view malicious content. id: CVE-2021-33829 info: name: Drupal 7 CKEditor XSS author:...
CVE-2024-37888
CVE-2024-37888 This repository documents vulnerability details and exploit for CVE-2024-37888 discovered and reported by myself. Metrics CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS: 6.1 MEDIUM Vulnerability Overview This Proof of Concept POC...
CVE-2018-15961
CVE-2018-15961 Unrestricted file upload in Adobe ColdFusion POST /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 Host: coldfusion:port User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/62.0.3202.9 Safari/537.36 Content-Type:...
CVE-2018-15961
CVE-2018-15961 - Adobe ColdFusion 2018 RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2018. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If...
Drupal 10.6.x < 10.6.17 / 11.3.x < 11.3.17 / 11.4.x < 11.4.7 Drupal Vulnerability (SA-CORE-2026-013)
According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.17, 11.3.x prior to 11.3.17, or 11.4.x prior to 11.4.7. It is, therefore, affected by a vulnerability. - The Drupal project uses the CKEditor library for WYSIWYG editing. CKEdit...
CVE-2026-78741
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
EUVD-2026-74260
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741: Improper Neutralization of Input During Web Page Generation
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741
Silverpeas Core versions
PT-2026-88461
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
Malicious code in @onereach/ckeditor5-build-classic (npm)
npm/@onereach/ckeditor5-build-classic is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...
