CVE-2019-13127

mxGraph (up to version 4.0.0) and the draw.io Diagrams plugin for Confluence are vulnerable to cross-site scripting due to improper validation/sanitization of a color field in javascript/examples/grapheditor/www/js/Dialogs.js. Multiple sources (NVD, OSV, GHSA, CNVD, etc.) describe an XSS conditio...

CVE-2022-40440

mxGraph version 4.2.2 contains a cross-site scripting (XSS) vulnerability in the setTooltips() function. The provided connected records confirm the flaw but do not include concrete exploit details or official patches within the documents. A PT-2022-25387 entry recommends disabling the setTooltips...