CVE-2020-26523

Froala Editor before 3.2.2 allows XSS via pasted content...

CVE-2020-26523

Froala Editor before 3.2.2 allows XSS via pasted content...

CVE-2020-26523

Froala Editor before 3.2.2 allows XSS via pasted content...

CVE-2020-26523

Froala Editor prior to 3.2.2 is vulnerable to XSS via pasted content . Affected: Froala Editor (WYSIWYG) before 3.2.2; root cause: improper handling of pasted HTML. Impact: cross-site scripting (CVSSv3.1 base score 6.1; vector Nv: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation details are not...

CVE-2019-19935

Froala Editor before 3.2.3 allows XSS...

CVE-2019-19935

Froala Editor before 3.2.3 allows XSS...

Cross site scripting

Froala Editor before 3.2.3 allows XSS...

CVE-2019-19935

Froala Editor prior to 3.2.3 is vulnerable to DOM-based XSS due to improper sanitization when HTML is inserted into the DOM. Affected versions include 3.2.2 and earlier; exploitation can occur via editor content manipulation (e.g., switching to code view). Remediation: upgrade to 3.2.3 or later w...

CVE-2019-19935

Froala Editor before 3.2.3 allows XSS...

Froala WYSIWYG HTML Editor Cross-Site Scripting Vulnerability

Froala WYSIWYG HTML Editor is a U.S. Froala company's Web-based WYSIWYG rich text editor . A cross-site scripting vulnerability exists in Froala WYSIWYG HTML Editor versions 3.0.6 through 3.1.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. A...

PT-2020-10296 · Froala · Froala Editor

Name of the Vulnerable Software and Affected Versions: Froala Editor versions prior to 3.2.3 Description: A DOM-based cross-site scripting XSS issue exists because HTML code in the editor is not correctly sanitized when inserted into the DOM. This allows an attacker that can control the editor...

Cross-Site Scripting (XSS)

froala-editor is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser through the WYSIWYG editor by inserting a malicious link. This allows the attacker to steal session tokens or perform unwanted actions on behalf of the user...