47 matches found
CVE-2025-6674
CVE-2025-6674 affects the Drupal CKEditor5 Youtube plugin. The issue is improper input neutralization that enables Cross-site Scripting (XSS) through the YouTube embedding workflow. Affected versions are CKEditor5 Youtube 0.0.0 through 1.0.2; remediation is to update to 1.0.3 or later. Severity i...
CVE-2025-6674 CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...
CVE-2025-6674 CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...
CVE-2025-6674 CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...
PT-2025-26963 · Unknown · Ckeditor5 Youtube
Name of the Vulnerable Software and Affected Versions: CKEditor5 Youtube versions 0.0.0 through 1.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting X...
Drupal CKEditor5 Youtube 安全漏洞
Drupal CKEditor5 Youtube is a video integration plugin for the Drupal community. A security vulnerability exists in Drupal CKEditor5 Youtube versions prior to 1.0.3, which stems from improper input neutralization and could lead to cross-site scripting attacks...
Drupal CKEditor5 Youtube module < 1.0.4 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by nico.b in WordPress Module CKEditor5 Youtube versions 1.0.4...
CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081
The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into the CKEditor 5 text editor. The module doesn't sufficiently validate iframe sources under the scenario where a user embeds a video using the CKEditor YouTube integration leading...
@authorium/ckeditor5-build-multi-root (>=41.3.1, <=41.4.2), @eagerworks/ckeditor5-build-multi-root (>=41.4.2-auth.1, <=41.4.2) +8 more potentially affected by CVE-2025-25299 via @ckeditor/ckeditor5-real-time-collaboration (>=41.3.0-alpha.2, <=44.2.0-alpha.16)
@ckeditor/ckeditor5-real-time-collaboration NPM version =41.3.0-alpha.2, =41.3.1, =41.4.2-auth.1, =1.0.1, =4.0.45, =18.0.20, =0.0.8, =41.3.0-alpha.2, =1.0.8, =1.0.10 - htmljs-code 44.0.30 - markdownvue3demo 0.0.1 Source cves: CVE-2025-25299 Source advisory: OSV:GHSA-J3MM-WMFM-MWVH...
@mythpe/js-helpers (>=4.0.45, <=4.0.99), @ng-zi/extensions (>=18.0.20, <=18.0.24) +4 more potentially affected by CVE-2025-25299 via ckeditor5-premium-features (>=42.0.2, <=43.3.1)
ckeditor5-premium-features NPM version =42.0.2, =4.0.45, =18.0.20, =0.0.8, =1.0.8, =1.0.10 - htmljs-code 44.0.30 - markdownvue3demo 0.0.1 Source cves: CVE-2025-25299 Source advisory: OSV:GHSA-J3MM-WMFM-MWVH...
MAL-2024-9541 Malicious code in ckeditor5-table (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9540 Malicious code in ckeditor5-cloud-services (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ckeditor5-cloud-services (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9539 Malicious code in ckeditor5-block-quote (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9538 Malicious code in ckeditor5-alignment (npm)
--- -= Per source details. Do not edit below this line.=-...
4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), @_mehrad/ckeditor5-build-mmr (>=41.3.1, <=42.0.3) +586 more potentially affected by CVE-2024-45613 via @ckeditor/ckeditor5-clipboard (>=40.0.0, <=43.1.0-alpha.8)
@ckeditor/ckeditor5-clipboard NPM version =40.0.0, =0.0.1, =41.3.1, =2.1.0, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.0-Beta1, =0.0.17-Beta, =0.0.15-Beta100, =0.0.1, =1.0.0, =0.0.1, =0.0.5 and more Source cves: CVE-2024-45613 Source advisory: OSV:GHSA-RGG8-G5X8-WR9V...
Cross-site scripting in CKEditor5
CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is adding...
GHSA-6P89-3P7C-QRHV Cross-site scripting in CKEditor5
CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is adding...
CVE-2022-48110
CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is addin...
CKSource CKEditor5 35.4.0 Cross Site Scripting Vulnerability
Exploit Title: Cross Site Scripting in CKSource's CKEditor5 35.4.0 Google Dork: N/A Exploit Author: Manish Pathak Vendor Homepage: https://cksource.com/ Software Link: https://ckeditor.com/ckeditor-5/download/ Version: 35.4.0 Tested on: Linux / Web CVE : CVE-2022-48110 CKSource CKEditor5 35.4.0 w...