Vditor allows Cross-site Scripting via an attribute of an `A` element

Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...

GHSA-M5JF-8CRM-R65M Vditor allows Cross-site Scripting via an attribute of an `A` element

Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...

PT-2024-25903 · Vditor · Vditor

Name of the Vulnerable Software and Affected Versions: Vditor version 3.10.3 Description: The issue allows XSS via an attribute of an A element. The vendor indicates that a user is supposed to mitigate this via sanitize=true. Recommendations: For Vditor version 3.10.3, to mitigate the issue, set...

CVE-2024-34449

CVE-2024-34449 affects Vditor 3.10.3, with XSS via an attribute of an A element. The underlying issue is insufficient sanitization; vendor guidance is to mitigate by enabling sanitize=true. CVSS 3.1 base score 6.1 (Network attack, low complexity, no privilege, user interaction required, scope cha...

GHSA-32VW-R77C-GM67 Withdrawn Advisory: marked cross-site scripting vulnerability

Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set...

PT-2018-4711

Name of the Vulnerable Software and Affected Versions marked versions 0.3.5 and earlier Description The issue arises from the way marked parses input, specifically HTML entities, allowing for the bypass of content injection protection when sanitize: true is configured. This enables the injection ...

CVE-2016-10531: Improper Neutralization of Input During Web Page Generation

marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection sanitize: true to inject a javascript: URL. This flaw exists because NNanythin...