Simditor cross-site scripting vulnerability (CNVD-2019-14696)

Simditor is a browser-based WYSIWYG text editor. A cross-site scripting vulnerability exists in Simditor 2.3.21 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

CVE-2018-19048: Improper Neutralization of Input During Web Page Generation

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...

PT-2019-9725

Name of the Vulnerable Software and Affected Versions Simditor versions prior to 2.3.22 Description The issue allows for DOM XSS via an onload attribute within a malformed SVG element. It is caused by the package not sanitizing user input that is rendered with innerHTML, allowing attackers to...

Simditor Cross-Site Scripting Vulnerability

Simditor is a browser-based WYSIWYG text editor. A cross-site scripting vulnerability exists in Simditor version 2.3.11. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross-site Scripting (XSS)

Simditor is vulnerable to cross-site scripting XSS attacks. The application does not properly sanitize the TEXTAREA element, allowing a malicious user to inject and execute arbitrary Javascript...

CVE-2018-6464

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1...

Design/Logic Flaw

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1...

CVE-2018-6464

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1...

CVE-2018-6464

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1...

CVE-2018-6464

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1...

CVE-2018-6464

Summary : CVE-2018-6464 affects Simditor v2.3.11, where an attacker can trigger cross-site scripting (XSS) by crafting an SVG onload payload inside a TEXTAREA element, demonstrated with Firefox 54.0.1. The root cause is not explicitly detailed beyond the use of an SVG/onload payload in a TEXTAREA...

CVE-2018-6464: Improper Neutralization of Input During Web Page Generation

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1...

PT-2018-17561

Name of the Vulnerable Software and Affected Versions Simditor version 2.3.11 Description The issue allows for XSS via crafted use of svg/onload=alert in a TEXTAREA element. This has been demonstrated using Firefox 54.0.1. Recommendations For Simditor version 2.3.11, consider disabling the use of...