CKEditor vulnerabilities
5 known CVE vulnerabilities in CKEditor, translated and rated.
- CVE-2023-31541Critical
The CKEditor v1.2.3 plugin for Redmine has an unrestricted file upload vulnerability in the 'Browse and upload images' feature, allowing arbitrary files to be uploaded to the server.
- CVE-2020-9281Medium
CKEditor 4.0 before 4.14 contains a cross-site scripting (XSS) vulnerability in the HTML Data Processor. A remote attacker can inject arbitrary script through a crafted "protected" comment (with the cke_protected syntax).
- CVE-2021-26272Medium
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
- CVE-2021-26271Medium
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
- CVE-2020-27193Medium
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of the editor inputs.