KindEditor is vulnerable to XSS

KindEditor is a set of open source HTML visual editor , mainly used to allow users to get WYSIWYG editing effect on the site , compatible with IE, Firefox, Chrome, Safari, Opera and other major browsers . KindEditor has an XSS vulnerability. An attacker can exploit the vulnerability by uploading...

Reflective Cross-Site Scripting Vulnerability in Kindeditor

KindEditor is a set of open source online HTML editor . Kindeditor suffers from a reflective cross-site scripting vulnerability. Allows an attacker to construct XSS statements , pop-up box operation , to obtain user cookies and other information...

Stored Cross-Site Scripting Vulnerability in Knight CMS Version 3.7

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. A stored cross-site scripting vulnerability exists in Knight CMS version 3.7. Because the editor in KindEditor version 4.1.10 fails to filter input content, an attacker can exploit the vulnerability to execute arbitrary...

kindeditor<=4.1.5文件上传漏洞

漏洞描述漏洞存在于kindeditor编辑器里，你能上传.txt和.html文件，支持php/asp/jsp/asp.net漏洞存在于小于等于kindeditor4.1.5编辑器中关键字： allinurl:/examples/uploadbutton.html allinurl:/php/uploadjson.php / .asp /...

PHPYUN云人才系统持久型XSS

简要描述： 可盲打管理员，演示站已验证 详细说明： phpyun云人才系统，默认自带一个kindeditor编辑器，而编辑器自带的演示文件并没有删除。通过演示文件，我们可以上传.html后缀的文件，其中包含任意javascript代码，让管理员访问可盲打管理员cookie。 位置在 data/kindeditor/php/uploadjson.php中： 不过有几点要说明的。 01.如果kindeditor目录下不存在attached目录的话，没法真正上传成功。但只要管理员在后台发表过文章（基本上只要这个站是活的），就会有这个目录。...

YXcmsApp某处xss导致getshell

简要描述： xss到后台导致getshell一条龙服务不过略鸡肋。 详细说明： YXCMS是一款面向企业的内容管理系统，采用三级缓存，MVC架构以BSD协议开源。 注册了用户以后来到用户管理页面，点击信息发布 - 增加咨询，发现是一个富文本编辑器，kindeditor。不管是什么编辑器，既然给了一个用户这么大的权限，这种情况下很容易出现xss。 随便输入点什么东西，抓包，修改content字段内容，写你的xss代码，什么都行。 好了。管理员在后台就能看到我提交的文章： 然后编辑的话就能触发xss：...

KindEditor 4.1.7 /php/file_manager_json.php 路径泄漏

/php/filemanagerjson.php文件代码第48行打印出了绝对路径，导致路径泄漏漏洞产生。 KindEditor 4.1.7...

KindEditor (v.3.x->4.1.5) <= Multiple File/Shell Upload Vulnerability

This bug in KindEditor you can upload remote files .txt .html ...etc with multiple JSON upload langs type PHP / ASP / JSP / ASP.NET this bug found in old versions by some author , but is still work is latest version . - Latest V. is 4.1.5 , Released on Jan 19, 2013...

KindEditor 4.1.5 Shell Upload

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

KindEditor - Multiple Arbitrary File Upload Vulnerabilities

KindEditor - Multiple Arbitrary File Upload Vulnerabilities source: https://www.securityfocus.com/bid/58431/info KindEditor is prone to multiple remote file-upload vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to upload arbitrary...

KindEditor - Multiple Arbitrary File Upload Vulnerabilities

source: https://www.securityfocus.com/bid/58431/info KindEditor is prone to multiple remote file-upload vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to upload arbitrary code and run it in the context of the web server process...

KindEditor - name Cross-Site Scripting

KindEditor - name Cross-Site Scripting source: https://www.securityfocus.com/bid/55172/info KindEditor is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of...

KindEditor 4.1.2 Cross Site Scripting

KindEditor 4.1.2 name parameter Reflected XSS Vulnerability Vendor: Shanghai Hao Yue Software Co., Ltd. Product web page: http://www.kindeditor.net Affected version: 4.1.2 and 4.0.6 Summary: KindEditor online HTML editor is a set of open source, mainly for users on the site to get WYSIWYG editing...

KindEditor - 'name' Cross-Site Scripting

source: https://www.securityfocus.com/bid/55172/info KindEditor is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

KindEditor 4.1.2 (name parameter) Reflected XSS Vulnerability

Summary KindEditor online HTML editor is a set of open source, mainly for users on the site to get WYSIWYG editing effects, developers can replace the traditional multi-line text input box textarea KindEditor rich visualization text input box. Description KindEditor is prone to a reflected...

Intelligent core multi-language enterprise website management system 4. 1. 0 SQL injection and upload vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability type: SQL injection Test version: the intelligent core multi-language enterprise website management system 4. 1. 0 Editor Version: KindEditor 4.0.3 Vulnerability description: ① Injection vulnerability Vulnerability file:\Cn\About. asp & \Include\Bottom. asp The exploit: the Add Tabl...

KindEditor 3.5.5 遍历目录漏洞

No description provided by source. 1.http://localhost/67cms/kindeditor/php/filemanagerjson.php?path=/ //path=/，爆出绝对路径D:\AppServ\www\67cms\kindeditor\php\filemanagerjson.php 2.http://localhost/67cms/kindeditor/php/filemanagerjson.php?path=AppServ/www/67cms/ //根据爆出的绝对路径，修改path的值为AppServ/www/67cms/...

Kindeditor traverse the directory 0DAY-vulnerability warning-the black bar safety net

Author: sub - ↘meter Version: 3.4.2 Description: KindEditor is an open source HTML visual editor, mainly used to allow users on the site to get WYSIWYG editing effects, compatible with IE, Firefox, Chrome, Safari, Opera and other mainstream browser. KindEditor using JavaScript, you can seamlessly...