Cross-site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. The vulnerability exists through the URL sanitization logic of the SaxParser...

GHSA-W7JX-J77M-WP65 Cross-site scripting vulnerability in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are...

Cross-site scripting vulnerability in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are...

@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.1.9) +56 more potentially affected by CVE-2024-21911 via tinymce (>=5.0.6, <=5.5.1)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.18.0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =0.17.0, =0.1.0, =0.0.1, =0.0.4 - @yanghp/amis 1.1.0 and more Source cves: CVE-2024-21911 Source advisory: GHSA-W7JX-J77M-WP65...

@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.1.9) +56 more potentially affected by CVE-2024-21911 via tinymce (>=5.0.6, <=5.5.1)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.18.0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =0.17.0, =0.1.0, =0.0.1, =0.0.4 - @yanghp/amis 1.1.0 and more Source cves: CVE-2024-21911 Source advisory: OSV:GHSA-W7JX-J77M-WP65...

Regex denial of service vulnerability in codesample plugin

Impact A regex denial of service ReDoS vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the codesample plugin using TinyMCE 5.5.1 or...

@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.1.9) +56 more potentially affected by unknown CVE via tinymce (>=5.0.6, <=5.5.1)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.18.0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =0.17.0, =0.1.0, =0.0.1, =0.0.4 - @yanghp/amis 1.1.0 and more Source cves: unknown CVE Source advisory: GHSA-H96F-FC7C-9R55...

@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.1.9) +56 more potentially affected by unknown CVE via tinymce (>=5.0.6, <=5.5.1)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.18.0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =0.17.0, =0.1.0, =0.0.1, =0.0.4 - @yanghp/amis 1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H96F-FC7C-9R55...

GHSA-H96F-FC7C-9R55 Regex denial of service vulnerability in codesample plugin

Impact A regex denial of service ReDoS vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the codesample plugin using TinyMCE 5.5.1 or...

PT-2021-24352 · Tinymce · Tinymce

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.6.0 Description: A stored cross-site scripting vulnerability was discovered in the URL sanitization logic of the core parser, allowing arbitrary JavaScript execution when inserting specially crafted content into th...

PT-2021-24429

Name of the Vulnerable Software and Affected Versions: TinyMCE versions 5.5.1 and lower Description: A regex denial of service ReDoS vulnerability was discovered in a dependency of the codesample plugin, allowing poorly formed ruby code samples to lock up the browser while performing syntax...

Umbraco Cross-Site Scripting Vulnerability (CNVD-2020-75634)

Umbraco is an open source content management system CMS based on ASP.NET technology. Umbraco 8.9.1 and earlier versions are vulnerable to a stored cross-site scripting vulnerability. An attacker can exploit this vulnerability to inject arbitrary JavaScript code into an iframe when editing content...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

Cross site scripting

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

CVE-2020-5809: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

PT-2020-18726

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 8.9.2 Description A stored XSS issue exists, allowing an authenticated user to inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor. This is possible because TinyMC...