Unrestricted file upload

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

CVE-2011-4906

CVE-2011-4906 concerns a vulnerability in the TinyMCE 3.0 editor integrated into Joomla! prior to 1.5.13. The connected documents confirm that an improper file upload mechanism could allow arbitrary PHP code execution via the TinyMCE-based upload path, enabling an attacker to execute code remotel...

CVE-2011-4906

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...

Cross-site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. The attack exists because it does not prevent the attacker from injecting a malicious script into the editor via the clipboard or APIs, allowing to execute the script when a user loads the editor...

GHSA-27GM-GHR9-4V95 Cross-site scripting vulnerability in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the HTML comments and CDATA information...

8x8: (Critical) Remote Code Execution Through Old TinyMCE upload bypass

A third party marketing site utilized an outdated version of TinyMCE that was vulnerable to CVE-2011-4906...

CVE-2014-4548

CVE-2014-4548 : The Ruven Toolkit WordPress plugin (

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

Cross site scripting

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2013-1426

Affected software: Mahara. Vulnerable component: TinyMCE editor used in Mahara pages. Root cause: Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary script/HTML via the TinyMCE editor. Impact: potential remote code execution in the...

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2016-10957

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter...

CVE-2016-10957

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

Cross site scripting

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

Magento 2.x suffers a stored XSS in the admin panel, affecting 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated user with access to edit product information via the TinyMCE editor can exploit it. Root cause: lack of input sanitization in admin product editing flow. Impa...