Lucene search
Veracode Vulnerability DatabaseVERACODE:26334HistoryAug 17, 2020 - 3:56 a.m.
Cross-Site Scripting (XSS)
2020-08-1703:56:15
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
0.001 Low
EPSS
Percentile
45.5%
tinymce is vulnerable to cross-site scripting (XSS). An attacker is able to inject and execute arbitrary Javascript in a user’s browser when the library is configured in classic editing mode. The stripping and sanitization logic of TinyMCE can be bypassed using nested and non-terminated HTML tags, which can allow an attacker to inject an `` tag with arbitrary src and onerror values.
Related
osv
osv
Cross-site scripting vulnerability in TinyMCE
2020-08-11 14:55:01
CVE-2020-12648
2020-08-14 14:15:12
nvd
nvd
CVE-2020-12648
2020-08-14 14:15:12
ubuntucve
ubuntucve
CVE-2020-12648
2020-08-14 00:00:00
cvelist
cvelist
CVE-2020-12648
2020-08-14 13:52:29
threatpost
threatpost
High-Severity TinyMCE Cross-Site Scripting Flaw Fixed
2020-08-13 12:34:39
cve
cve
CVE-2020-12648
2020-08-14 14:15:12
debiancve
debiancve
CVE-2020-12648
2020-08-14 14:15:12
prion
prion
Cross site scripting
2020-08-14 14:15:00
github
github
Cross-site scripting vulnerability in TinyMCE
2020-08-11 14:55:01