Description

Cross site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters.

Remediation

Upgrade to the latest version of FCKeditor.

References

CVE-2012-4000

Related Vulnerabilities

MySQL CVE-2023-22005 Vulnerability (CVE-2023-22005)

MySQL CVE-2022-21485 Vulnerability (CVE-2022-21485)

PHP Improper Input Validation Vulnerability (CVE-2007-4840)

Phusion Passenger Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-10345)

MySQL CVE-2016-0661 Vulnerability (CVE-2016-0661)

Severity

High

Classification

CVE-2012-4000 CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

XSS Known Vulnerabilities