Description

Cross site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters.

Remediation

Upgrade to the latest version of FCKeditor.

References

CVE-2012-4000

Related Vulnerabilities

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-2550)

MySQL CVE-2017-10378 Vulnerability (CVE-2017-10378)

PHP Numeric Errors Vulnerability (CVE-2011-1471)

MySQL CVE-2019-2938 Vulnerability (CVE-2019-2938)

Magento XML Injection (aka Blind XPath Injection) Vulnerability (CVE-2021-21019)

Severity

High

Classification

CVE-2012-4000 CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

XSS Known Vulnerabilities