Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/ckeditor@4.7.0
purl pkg:npm/ckeditor@4.7.0
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 2.8
Vulnerabilities affecting this package (9)
Advisory Summary Fixed in package version
CVE-2021-32809
Aliases:
GHSA-7889-rm5j-hpgg
Code Injection ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered … There are no reported fixed by versions.
CVE-2021-26271

Inclusion of Functionality from Untrusted Control Sphere It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading … There are no reported fixed by versions.
CVE-2023-28439
Aliases:
GHSA-vh5c-xwqv-cv9g
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site … There are no reported fixed by versions.
CVE-2022-24729
Aliases:
GHSA-f6rf-9m92-x2hh
Improper Input Validation CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in … There are no reported fixed by versions.
CVE-2021-37695
Aliases:
GHSA-m94c-37g6-cjhc
Cross-site Scripting ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered … There are no reported fixed by versions.
GHSA-g68x-vvqq-pvw3
Aliases:
CVE-2018-17960
Ckeditor XSS Vulnerability CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS …
4.11.0
Vulnerable
4.11.0
Vulnerable
CVE-2021-26272

Inclusion of Functionality from Untrusted Control Sphere It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading … There are no reported fixed by versions.
CVE-2018-17960

Cross-site Scripting CKEditor allows user-assisted XSS involving a source-mode paste.
4.11.0
Vulnerable
4.11.0
Vulnerable
CVE-2022-24728
Aliases:
GHSA-4fc4-4p5g-6w89
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability … There are no reported fixed by versions.
This package is not known to fix any advisories.