Simditor XSS Vulnerability

Description

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.11

References

• GHSA-p9wj-wrrm-84m5
• CVE-2018-6464
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Ckeditor XSS Vulnerability - CVE-2018-17960
• SimpleMDE XSS Vulnerability - CVE-2018-19057
• XSS vulnerability that affects bootstrap - CVE-2018-20676
• XSS vulnerability that affects bootstrap - bootstrap - CVE-2018-20676

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

simditor