Tiny: Security Vulnerabilities
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
CVSS Score
4.2
EPSS Score
0.009
Published
2021-12-03
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.
CVSS Score
6.1
EPSS Score
0.002
Published
2020-08-14
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
CVSS Score
6.1
EPSS Score
0.005
Published
2020-08-10
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
CVSS Score
9.8
EPSS Score
0.619
Published
2020-02-12
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.
CVSS Score
9.8
EPSS Score
0.359
Published
2020-02-12
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.
CVSS Score
6.1
EPSS Score
0.008
Published
2019-07-17
Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.NET\ICSFileServer.
CVSS Score
7.5
EPSS Score
0.007
Published
2019-03-25
Page 2