CVE-2013-1426

Affected software: Mahara. Vulnerable component: TinyMCE editor used in Mahara pages. Root cause: Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary script/HTML via the TinyMCE editor. Impact: potential remote code execution in the...

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2013-1426: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

PT-2019-6847

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.5.9 Mahara versions 1.6.x prior to 1.6.4 Description The issue allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor. This is a Cross-site Scripting XSS issue. Recommendations For Maha...

Cross site scripting

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

Magento 2.x suffers a stored XSS in the admin panel, affecting 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated user with access to edit product information via the TinyMCE editor can exploit it. Root cause: lack of input sanitization in admin product editing flow. Impa...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

PT-2019-18791

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description A stored cross-site scripting issue exists in the admin panel, specifically when an authenticated user edits Product...

Dropbox: Forum posts and private messages are poorly sanitized, allowing execution of arbitrary JavaScript

The reporter informed us of both stored XSS vulnerabilities as well as unsafe css attributes that were allowed in forum posts due to TinyMCE editor. An upgrade to lithium's forum platform appears to have mitigated these vulnerabilities...

UBUNTU-CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

Roundcube Webmail 0.8.0 - Stored XSS

No description provided by source. !/usr/bin/python ''' Exploit Title: Roundcube Webmail Stored XSS. Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://roundcube.net Software Link:...

TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilities

No description provided by source. ============================================================================== TinyBrowser TinyMCE Editor File browser 1.41.6 - Multiple Vulnerabilities ============================================================================== Discovered by Aung Khant, YGN...

Fedora 20 : moodle-2.5.3-1.fc20 (2013-21312)

Latest upstreams, multiple security fixes. Name: CVE-2013-6780 URL: https://vulners.com/cve/CVE-2013-6780 Assigned: 20131112 Reference: https://yuilibrary.com/support/20131111-vulnerability/ Cross-site scripting XSS vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 throu...

Code injection

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

UBUNTU-CVE-2013-3630

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

CVE-2013-3630

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

CVE-2013-3630

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...

CVE-2013-3630: Improper Control of Generation of Code

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor...