Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
tinymce tinymce vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2022-23166
Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the L...
Sysaid Sysaid
9.8
CVSSv3
CVE-2020-29592
An issue exists in Orchard prior to 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an malicious user to upload dangerous executables that bypass the file types allowed (regardless of the file types allowed list...
Orchardproject Orchard
9.8
CVSSv3
CVE-2011-4908
TinyBrowser plugin for Joomla! prior to 1.5.13 allows arbitrary file upload via upload.php.
Tiny Tinybrowser
2 EDB exploits
9.8
CVSSv3
CVE-2011-4906
Tiny browser in TinyMCE 3.0 editor in Joomla! prior to 1.5.13 allows file upload and arbitrary PHP code execution.
Tiny Tinybrowser
1 EDB exploit
8.8
CVSSv3
CVE-2023-44470
Cross-Site Request Forgery (CSRF) vulnerability in Kvvaradha Kv TinyMCE Editor Add Fonts plugin <= 1.1 versions.
Kvvaradha Kv Tinymce Editor Add Fonts
7.2
CVSSv3
CVE-2022-30529
File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows malicious users to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemana...
Isic.lk Project Isic.lk
6.1
CVSSv3
CVE-2024-21908
TinyMCE versions prior to 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
Tiny Tinymce
6.1
CVSSv3
CVE-2024-21910
TinyMCE versions prior to 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.
Tiny Tinymce
6.1
CVSSv3
CVE-2024-21911
TinyMCE versions prior to 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
Tiny Tinymce
6.1
CVSSv3
CVE-2023-48219
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability exists in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard...
Tiny Tinymce
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2018-25103
CVE-2024-36279
CVE-2024-38457
elevation of privilege
CVE-2024-27801
CVE-2024-30103
NULL pointer dereference
CVE-2024-6057
XML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »