CVE-2023-26149

CVE-2023-26149 affects quill-mention before 4.0.0 with XSS risk due to improper user-input sanitization in renderList. The issue arises when the mentions list uses unsafe user-sourced data, enabling injection when a Quill user types @. The vulnerability is documented across multiple feeds (Red Ha...

CVE-2023-26149

Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization, via the renderList function. Note: If the mentions list is sourced from unsafe user-sourced data, this might allow an injection attack when a Quill user hits @...

CVE-2023-26149

Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization, via the renderList function. Note: If the mentions list is sourced from unsafe user-sourced data, this might allow an injection attack when a Quill user hits @...

Quill Cross-Site Scripting Vulnerability

Quill is a Quill open source application. Provides application editor functionality. A cross-site scripting vulnerability exists in Quill quill-mention versions prior to 4.0.0, which stems from improper input cleanup and is susceptible to cross-site scripting XSS attacks...

PT-2023-20527 · Unknown · Quill-Mention

Name of the Vulnerable Software and Affected Versions: quill-mention versions prior to 4.0.0 Description: The issue is related to improper user-input sanitization, which can lead to Cross-site Scripting XSS attacks. This occurs via the renderList function. If the mentions list is sourced from...

Cross-site Scripting (XSS)

Overview quill-mention is a @mentions for the Quill rich text editor Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization, via the renderList function. Note: If the mentions list is sourced from unsafe user-sourced data, this might...

Cross-Site Scripting

Overview A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. No patch exists and no further releases are planned. Recommendation Avoid using quill as there ...

168wangxiao-ui (>=0.3.6 <=0.3.70), 3achatlibrary (>=1.0.0 <=1.0.9) +4575 more potentially affected by CVE-2021-3163 via quill (>=0.19.14 <=1.3.7)

quill NPM version =0.19.14, =0.3.6, =1.0.0, =19.0.0, =1.0.1, =1.0.0, =1.0.10, =3.1.1-0, =1.0.7, =19.0.0, =0.0.1, =3.0.10 and more Source cves: CVE-2021-3163 Source advisory: OSV:GHSA-4943-9VGG-GR5R...

GHSA-4943-9VGG-GR5R Cross-site Scripting in quill

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. No patch exists and no further releases are planned. This CVE is disputed. Researchers have claimed that...

Cross-site Scripting in quill

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. No patch exists and no further releases are planned. This CVE is disputed. Researchers have claimed that...

Slab Quill Cross-Site Scripting Vulnerability

Slab Quill is a rich text editor with good compatibility and extensibility. A stored cross-site scripting vulnerability exists in the HTML editor of Slab Quill version 4.8.0, which can be exploited by an attacker to execute arbitrary JavaScript...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

CVE-2021-3163

Slab Quill 4.8.0 contains a stored XSS in its HTML editor. An attacker can inject JavaScript by storing an XSS payload using a crafted onloadstart attribute on an IMG element, leading to arbitrary script execution. Multiple sources (NVD entry, CNVD, OSV/GHSA advisories) describe the issue; adviso...

PT-2021-19452 · Unknown · Slab Quill

Name of the Vulnerable Software and Affected Versions: Slab Quill version 4.8.0 Description: A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload, specifically a crafted onloadstart attribute of an IMG element, in a text...

Quill 跨站脚本漏洞

Slab Quill is a rich text editor with good compatibility and extensibility. A stored cross-site scripting vulnerability exists in the HTML editor of Slab Quill version 4.8.0, which can be exploited by an attacker to execute arbitrary JavaScript...

@alessio.filippucci/admin-dashboard-core (=0.0.0-development), @avoux/invoicing-manager (>=1.0.6 <=2.0.0) +144 more potentially affected by unknown CVE via quill (>=0.19.14 <=1.3.6)

quill NPM version =0.19.14, =1.0.6, =4.6.201905201249, =4.6.201907261001, =4.5.201903181201, =7.11.2, =3.0.201812052008, =2.0.5-web, =1.0.9, =1.9.0, =0.4.2, =28.3.0, =46.3.1-beta.0 - @microsoft/sp-application-base =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-588M-9QG5-35PQ...