CKEditor <= 46.1.0 Reflected XSS Vulnerability

CKEditor 5 is prone to a reflected cross-site scripting XSS vulnerability when used with Angular. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Linux Distros Unpatched Vulnerability : CVE-2025-61261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's...

CVE-2025-61261

A reflected cross-site scripting XSS vulnerability has been identified in CKeditor allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

EUVD-2025-38297

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2025-61261

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2025-61261

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

UBUNTU-CVE-2025-61261

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CKEditor 安全漏洞

CKEditor is an enterprise WYSIWYG editor from CKEditor open source. A security vulnerability exists in CKEditor version v46.1.0 and Angular version v18.0.0, which stems from reflective cross-site scripting and could lead to an attacker executing arbitrary code in a user's browser environment...

CVE-2025-61261

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2025-61261

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2025-61261

A reflected cross-site scripting (XSS) vulnerability exists in CKeditor v46.1.0 when used with Angular v18.0.0 . This flaw allows an attacker to execute arbitrary code within a user's browser by injecting a crafted payload . To remediate this issue, users are recommended to update CKeditor to a v...

CVE-2025-61261: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2025-61261

A reflected cross-site scripting XSS vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

PT-2025-45490

Name of the Vulnerable Software and Affected Versions CKeditor version 46.1.0 Angular version 18.0.0 Description A reflected cross-site scripting XSS issue exists that allows attackers to execute arbitrary code within a user’s browser. This is achieved by injecting a crafted payload. The...

GHSA-2374-6CVW-QMX6 DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a rea...

DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Summary The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a rea...

Insecure Default Initialization of Resource

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the CKEditor Provider. An attacker can upload unauthorized files by accessing the...

CVE-2025-62802 DNN CKEditor Provider allows unauthenticated upload out-of-the-box

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most...

CVE-2025-62802 DNN CKEditor Provider allows unauthenticated upload out-of-the-box

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most...

CVE-2025-62802

CVE-2025-62802 affects the DNN (DotNetNuke) CKEditor Provider. Prior to version 10.1.1, the out-of-the-box HTML editing experience allows unauthenticated users to upload files, creating a potential vector for further security issues. The vulnerability is fixed in 10.1.1. Affected material indicat...