67 matches found
CVE-2026-124494
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...
CVE-2026-124491
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...
CVE-2026-124493
SunEditor versions prior to 3.4.0 are vulnerable to a stored cross-site scripting (XSS) flaw within the DocumentType constructor . The root cause is the injection of header textContent into innerHTML without proper HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers, which exe...
CVE-2026-124494
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the isSafeURL check but are decoded by browsers,...
EUVD-2026-119549
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...
EUVD-2026-119548
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mo...
CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...
CVE-2026-124494
The SunEditor text editor (versions before 3.4.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause lies in the html.clean() sanitizer's _normalizeURL() function, which incorrectly decodes named entities such as : into an empty string. This allows attackers to injec...
CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...
CVE-2026-124493
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mo...
CVE-2026-124493 SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mo...
CVE-2026-124492
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...
EUVD-2026-119547
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...
CVE-2026-124492 SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...
CVE-2026-124492
SunEditor versions prior to 3.4.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability within the ModalAnchorEditor component, specifically in the #createBookmarkList function. The root cause is the insertion of entity-decoded h1-h6 header textContent into the bookmark list using i...
CVE-2026-124491 SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...
CVE-2026-124491
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...
CVE-2026-124491 SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...
CVE-2026-124491
SunEditor versions prior to 3.4.0 are susceptible to a stored cross-site scripting (XSS) vulnerability within the FileUpload plugin 's create() method. The root cause is the assignment of server-returned file names to innerHTML without proper escaping. Attackers can upload files with malicious, H...
CVE-2026-124491 SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...