CVE-2021-3163

Slab Quill 4.8.0 contains a stored XSS in its HTML editor. An attacker can inject JavaScript by storing an XSS payload using a crafted onloadstart attribute on an IMG element, leading to arbitrary script execution. Multiple sources (NVD entry, CNVD, OSV/GHSA advisories) describe the issue; adviso...

CVE-2025-15056

The CVE-2025-15056 entry concerns Quill 2.0.3, where the HTML export feature contains a lack of data validation that enables Cross‑Site Scripting (XSS). The issue is documented across multiple sources (NVD, Red Hat, CIRCL, GHSA/OSV, and Snyk references) confirming the vulnerability in Quill’s HTM...