GHSA-v27h-j97p-wqmx

ghsaUSosv

The Preview plugin in CKEditor allows Cross-site scripting (XSS)

view advisory published 2022-05-17Licence: CC-BY-4.0

Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2014-5191US	medium4.3	1.83% (79th)	—	2014-08-07
Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

references

External citations — patches, advisories, analysis.

http://ckeditor.com/node/136981WEB
https://github.com/ckeditor/ckeditor4-releasesPACKAGE
https://github.com/ckeditor/ckeditor4/commit/b685874c6bc873a76e6e95916c43840a2b7ab08aWEB
https://nvd.nist.gov/vuln/detail/CVE-2014-5191ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan