@agentlab/ldkg-ui-basetable (0.1.1), @agentlab/ldkg-ui-charts (>=0.1.2, <=0.1.7) +424 more potentially affected by CVE-2022-23494 via tinymce (>=4.5.1, <=5.10.5)

tinymce NPM version =4.5.1, =0.1.2, =0.3.7, =0.1.7, =1.0.0, =1.0.0, =0.1.6, =0.0.1, =1.0.0-alpha.39-baliz, =4.3.0, =9.0.0-alpha.5, =0.5.0, =0.1.0, =0.0.4, =0.0.7 and more Source cves: CVE-2022-23494 Source advisory: MEND:CVE-2022-23494...

CVE-2022-23494

Summary (CVE-2022-23494): TinyMCE (open source rich text editor) suffers a cross-site scripting (XSS) vulnerability in alert/confirm dialogs when provided with malicious HTML, potentially allowing arbitrary JavaScript execution in the current user’s browser. Affected versions clock to TinyMCE 5.x...

CVE-2022-23494

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

PT-2022-16027

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.10.7 TinyMCE versions prior to 6.3.1 Description A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur ...

CVE-2022-23494: Improper Neutralization of Input During Web Page Generation

tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...

CVE-2022-30529: Unrestricted Upload of File with Dangerous Type

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php...

PT-2022-20160 · Tinymce +1 · Tinymce +1

Name of the Vulnerable Software and Affected Versions: asith-eranga ISIC tour booking versions through the version published on Feb 13th 2018 Description: The issue allows attackers to upload arbitrary files via "/system/application/libs/js/tinymce/plugins/filemanager/dialog.php" and...

Laravel-FileManager path traversal vulnerability

laravel-filemanager is a file upload/editor for Laravel 5 through 6 and CKEditor / TinyMCE. A path traversal vulnerability exists in versions of laravel-filemanager prior to 2.5.1, which stems from the fact that it allows reading arbitrary files by traversing directories via special URLs...

GHSA-95QR-67RX-9PGH Umbraco CMS vulnerable to stored XSS

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

Umbraco CMS vulnerable to stored XSS

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

GHSA-3CCX-7588-R6C6 Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

WordPress Custom TinyMCE Shortcode Buttons plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress Custom TinyMCE Shortcode Buttons plugin version 1.1 and earlier is vulnerable to a...

CVE-2022-1217

The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHPSELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...

CVE-2022-1217

The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHPSELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...

CVE-2022-1217

The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHPSELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...

CVE-2022-1217

CVE-2022-1217 affects the WordPress plugin Custom TinyMCE Shortcode Button (

WordPress plugin Custom TinyMCE Shortcode Button: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress Custom TinyMCE Shortcode Buttons plugin version 1.1 and earlier is vulnerable to a...

PT-2022-13720

Name of the Vulnerable Software and Affected Versions Custom TinyMCE Shortcode Button WordPress plugin versions 1.1 and earlier Description The issue arises from the lack of sanitization and escaping of the PHP SELF variable before it is outputted in an attribute on an admin page, leading to...

CVE-2022-1217: Improper Neutralization of Input During Web Page Generation

The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHPSELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...