GHSA-FX5H-3786-H2W6 PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

classes/GoogleSpell.php in the PHP Spellchecker aka Google Spellchecker addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote...

Moodle Authenticated Spelling Binary Remote Code Execution

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

GHSA-WXQG-FG7V-MMC6 Moodle Authenticated Spelling Binary Remote Code Execution

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

Sysaid Technologies SysAid 路径遍历漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, an Israeli company. A security vulnerability exists in Sysaid Technologies SysAid that stems from a file inclusion issue with the application. An unauthenticated attacker can exploit the vulnerabili...

PrestaShop Stored Cross-Site Scripting Vulnerability

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

GHSA-CRPG-2MM2-JJQF PrestaShop Stored Cross-Site Scripting Vulnerability

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...

WordPress Custom TinyMCE Shortcode Button plugin <= 1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Custom TinyMCE Shortcode Button plugin versions = 1.1. Solution Deactivate and delete. This plugin has been closed as of April 4, 2022 and is not available for download. This closure is temporary, pending a full revi...

WordPress TinyMCE Annotate plugin <= 1.1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress TinyMCE Annotate plugin versions = 1.1.2. Solution No patched version available...

WordPress TinyMCE Annotate plugin <= 1.1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress TinyMCE Annotate plugin versions = 1.1.2. Solution No patched version available...

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

CVE-2021-4035

CVE-2021-4035 corresponds to a stored XSS in Wocu Monitoring’s report-creation comments caused by an obsolete tinymce editor. Public materials (NVD/NVD-derived entries and CVE records) describe that an attacker must have an account with sufficient privileges to view/edit reports to exploit the is...

CVE-2021-4035 Wocu Monitoring stored Cross-Site Scripting (XSS)

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

PT-2022-11220 · Tinymce · Tinymce

Name of the Vulnerable Software and Affected Versions: tinymce editor affected versions not specified Description: A stored cross-site scripting issue has been identified in the comments section of report creation, caused by an obsolete version of the tinymce editor. To exploit this issue,...

Wocu Monitoring 跨站脚本漏洞

Wocu Monitoring is a console for Wocu. A cross-site scripting vulnerability exists in Wocu Monitoring versions 0.27 through 48.2, which stems from an outdated version of the tinymce editor that lacks filtering and escaping in the comments that create reports...

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports...

Feberr 12.7 Shell Upload Vulnerability

Exploit Title: Feberr - Multivendor Digital Products Marketplace arbitrary file upload Version 12.7 Google Dork: N/A Exploit Author: Sohel Yousef - email protected Software Link: https://www.codester.com/items/14224/feberr-multivendor-digital-products-marketplace Software link 2...

Feberr 12.7 Shell Upload

Exploit Title: Feberr - Multivendor Digital Products Marketplace arbitrary file upload Version 12.7 Google Dork: N/A Date: 24/01/2022 Exploit Author: Sohel Yousef - [email protected] Software Link: https://www.codester.com/items/14224/feberr-multivendor-digital-products-marketplace Software...

VulnCheck KEV: CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

Cross-site scripting vulnerability in TinyMCE plugins

Impact A cross-site scripting XSS vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the...