6 matches found
CVE-2026-62324
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...
CVE-2026-62324 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...
CVE-2026-62324 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...
CVE-2026-62324: Improper Neutralization of Input During Web Page Generation
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...
PT-2025-9549
Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...
PT-2023-20341
Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS Enterprise Sites versions 10.8.1 through 11.1 Description There is a stored Cross-site Scripting issue in Esri Portal for ArcGIS Enterprise Sites that may allow a remote, authenticated attacker to create a crafted link...