CVE-2017-6589

The CVE-2017-6589 vulnerability affects EpicEditor up to version 0.2.3, arising from an insecure default configuration of marked.js that does not escape input. This allows cross-site scripting via crafted HTML (e.g., an image tag) in previews rendered by the editor. Public references (including G...

CVE-2017-6591: Improper Neutralization of Input During Web Page Generation

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

CVE-2017-6589: Improper Neutralization of Input During Web Page Generation

EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document...