Description

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.

Remediation

References

https://github.com/Heartway/simditor/blob/master/simditor.docx

Related Vulnerabilities

CVE-2022-41918 Vulnerability in maven package org.opensearch.plugin:opensearch-security

CVE-2023-26920 Vulnerability in npm package fast-xml-parser

CVE-2022-39266 Vulnerability in npm package isolated-vm

CVE-2019-10801 Vulnerability in npm package enpeem

CVE-2019-9737 Vulnerability in npm package editor.md

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory