CK
Product
Ckeditor
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 18Low 0
Watch
Add Ckeditor to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-31541 | 9.8 | Jun 13 | A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be… Affected: 1.2.3 |
| CVE-2022-24729 | 7.5 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 4.0 before 4.18.0 |
| CVE-2011-4972 | 7.5 | Nov 13 | hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct… Affected: 7.x-1.4 |
| CVE-2021-26272 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space… Affected: 4.0 before 4.16 |
| CVE-2021-26271 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the… Affected: 4.0 before 4.16 |
| CVE-2024-43407 | 6.1 | Aug 21 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 4.0 before 4.25.0 |
| CVE-2024-24816 | 6.1 | Feb 7 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 4.0 before 4.24.0 |
| CVE-2024-24815 | 6.1 | Feb 7 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 4.0 before 4.24.0 |
| CVE-2023-28439 | 6.1 | Mar 22 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 4.0 before 4.21.0 |
| CVE-2022-48110 | 6.1 | Feb 13 | CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget Affected: 35.4.0 |
| CVE-2021-33829 | 6.1 | Jun 9 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript… Affected: 4.14.0 before 4.16.1 |
| CVE-2020-27193 | 6.1 | Nov 12 | A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and… Affected: 4.15.0 |
| CVE-2020-9440 | 6.1 | Mar 10 | A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by… Affected: 4.0 |
| CVE-2020-9281 | 6.1 | Mar 7 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted… Affected: 4.0 before 4.14 |
| CVE-2018-17960 | 6.1 | Nov 14 | CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste Affected: 4.0 before 4.11.0 |
| CVE-2022-24728 | 5.4 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: 4.0 before 4.18.0 |
| CVE-2021-41165 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: before 4.17.0 |
| CVE-2021-41164 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: 4.0 before 4.17.0 |
| CVE-2021-37695 | 5.4 | Aug 13 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: before 4.16.2 |
| CVE-2021-32809 | 5.4 | Aug 12 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: 4.5.2 before 4.16.2 |
| CVE-2021-32808 | 5.4 | Aug 12 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: 4.13.0 before 4.16.2 |
| CVE-2014-5191 | – | Aug 7 | Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 4.4.2; 4.4.0; 4.4.1 |
| CVE-2012-2067 | – | Sep 5 | Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal, when the core PHP… Affected: 6.x-1.0; 6.x-1.0; 6.x-1.1; 6.x-1.2; 6.x-1.3; 6.x-1.4; +13 more |
| CVE-2012-2066 | – | Sep 5 | Cross-site scripting (XSS) vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows… Affected: 6.x-1.0; 6.x-1.0; 6.x-1.1; 6.x-1.2; 6.x-1.3; 6.x-1.4; +13 more |
Showing 24