tinymce

9 results · Clear filters · Feed

• Medium 6.1
  CVE-2024-38357

  TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

  TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded int…

  tinymce tinymce roundcube tinymce Ubuntu npm Packagist PyPI NuGet
  Jun 19, 2024
• Medium 6.1
  CVE-2024-38356

  TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

  TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be…

  tinymce tinymce roundcube tinymce Ubuntu npm Packagist PyPI NuGet
  Jun 19, 2024
• Medium 4.3
  CVE-2024-29881

  TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

  TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially c…

  tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  Mar 26, 2024
• Medium 4.3
  CVE-2024-29203

  TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

  TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elemen…

  tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  Mar 26, 2024
• Medium 6.1
  CVE-2023-48219

  Special characters in unescaped text nodes can trigger mXSS in TinyMCE

  TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization accordi…

  tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  Nov 15, 2023
• Medium 6.1
  CVE-2023-45818

  Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

  TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a stri…

  tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  Oct 19, 2023
• Medium 6.1
  CVE-2023-45819

  Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

  TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions f…

  tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  Oct 19, 2023
• Medium 5.4
  CVE-2022-23494

  Cross-site scripting vulnerability in TinyMCE alerts

  tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialog…

  tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  Dec 8, 2022
• Medium —
  CVE-2019-1010091

  XSS in TinyMCE

  tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media eleme…

  tinymce tinymce tinymce tinymce Ubuntu npm
  Jul 17, 2019