CVE-2021-39393

CVE-2021-39393 affects mm-wiki v0.2.1, with a cross-site scripting (XSS) vulnerability via the markdown editor. The issue stems from insufficient input sanitization, enabling injection of malicious scripts. Impact and remediation details are limited across the provided sources; CVSS indicates a l...

CVE-2021-39393

mm-wiki v0.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the markdown editor...

mm-wiki 跨站脚本漏洞

mm-wiki is a Chinese phachon individual developers of a lightweight enterprise knowledge sharing and team collaboration software. It can be used to quickly build enterprise Wiki and team knowledge sharing platform. A security vulnerability exists in mm-wiki v0.2.1, which is caused by cross-site...

编号撤回

HTMLDOC is an open source program that converts HTML and Markdown files to EPUB, Indexed HTML, PostScript and PDF formats. This CVE number has been withdrawn...

GHSA-42WQ-RCH8-6F6J CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

Stored XSS via image markdown

Description The site allows creating markdown to get an image from a link, from which we can use it to generate XSS. Proof of Concept Payload: markdown Video: Youtube Only works on Google Chrome...

Cross-site Scripting (XSS)

@ckeditor/ckeditor5-markdown-gfm is vulnerable to cross-site scripting. An attacker can inject and execute a malicious javascript if the library uses an unsafe markup configuration inside the editor, initializes the editor on an element that uses an element other than as a base, or destroys the...

Renato 安全漏洞

Renato is an open source knowledge base platform that uses static Markdown files to power your knowledge base. A security vulnerability exists in Renato version v0.17.0 that stems from the use of weak passwords, which can be exploited by an attacker to crack a user's password via a brute-force...

Renato 跨站脚本漏洞

Renato is an open source knowledge base platform that uses static Markdown files to power your knowledge base. A security vulnerability exists in Renato version v0.17.0, which originates from an attacker with local access rights can upload a markdown file with malicious JavaScript that can be...

CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

UBUNTU-CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

[SECURITY] Fedora 36 Update: golang-github-msprev-fzf-bibtex-1.1-6.20220205gitd5df2c6.fc36

A BibTeX source for fzf. fzf-bibtex uses BibTool parse BibTeX files, caches the results, and supports vim integration for users of the fzf.vim plugin. It includes support for Markdown and LaTeX citation formats...

[SECURITY] Fedora 36 Update: golang-github-mmarkdown-mmark-2.2.10-6.fc36

Mmark is a powerful markdown processor written in Go, geared towards writing IETF documents. It is, however, also suited for writing complete books and ot her technical documentation, like the Learning Go book mmark source, and I-D text output...

GHSA-WFVX-FX73-3RFJ markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped...

markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped...

CVE-2020-28455

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped...

CVE-2020-28459

This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link...

CVE-2020-28455 Cross-site Scripting (XSS)

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped...

CVE-2020-28455

markdown-it-toc is vulnerable to Cross-site Scripting (XSS) because the title of the generated table of contents and the contents of headers are not escaped. This affects all versions of the package, enabling injection via the toc/title content. Multiple sources (GHSA, Snyk, Veracode, OSV, CVE li...