Younsoung Kim

CKEditor 5, a JavaScript rich-text editor, contains a cross-site scripting (XSS) issue within the General HTML Support feature. This issue arises from the insertion of specially crafted markup, potentially leading to unauthorized JavaScript code execution. The vulnerability is triggered when the editor is configured to use an unsafe General HTML Support configuration. The issue affects installations where General HTML Support is enabled and configured to allow unsafe markup.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS in the Webstix Admin Dashboard RSS Feed.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. This allows Command Injection in Dextaz Ping.

The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the Z-Downloads component.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into a website, potentially affecting users who access the compromised page.

The issue affects the Auto Poster, allowing for the unrestricted upload of files with dangerous types.