Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gb19-ydbs-a7b2
Vulnerability ID VCID-gb19-ydbs-a7b2
Aliases CVE-2022-23494
GHSA-gg8r-xjwq-4w92
Summary
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.01849 https://api.first.org/data/v1/epss?cve=CVE-2022-23494
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-gg8r-xjwq-4w92
cvssv3.1 5.4 https://github.com/tinymce/tinymce
generic_textual MODERATE https://github.com/tinymce/tinymce
cvssv3.1 5.4 https://github.com/tinymce/tinymce/commit/6923d85eba6de3e08ebc9c5a387b5abdaa21150e
generic_textual MODERATE https://github.com/tinymce/tinymce/commit/6923d85eba6de3e08ebc9c5a387b5abdaa21150e
cvssv3.1 5.4 https://github.com/tinymce/tinymce/commit/8bb2d2646d4e1a718fce61a775fa22e9d317b32d
generic_textual MODERATE https://github.com/tinymce/tinymce/commit/8bb2d2646d4e1a718fce61a775fa22e9d317b32d
cvssv3.1 5.4 https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92
cvssv3.1_qr MODERATE https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92
generic_textual MODERATE https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2022-23494
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-23494
cvssv3.1 5.4 https://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixes
generic_textual MODERATE https://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixes
cvssv3.1 5.4 https://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixes
generic_textual MODERATE https://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixes
cvssv3.1 5.4 https://www.tiny.cloud/docs/tinymce/6/file-image-upload/#images_upload_handler
generic_textual MODERATE https://www.tiny.cloud/docs/tinymce/6/file-image-upload/#images_upload_handler
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-23494
https://github.com/tinymce/tinymce
https://github.com/tinymce/tinymce/commit/6923d85eba6de3e08ebc9c5a387b5abdaa21150e
https://github.com/tinymce/tinymce/commit/8bb2d2646d4e1a718fce61a775fa22e9d317b32d
https://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixes
https://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixes
https://www.tiny.cloud/docs/tinymce/6/file-image-upload/#images_upload_handler
CVE-2022-23494 https://nvd.nist.gov/vuln/detail/CVE-2022-23494
GHSA-gg8r-xjwq-4w92 https://github.com/advisories/GHSA-gg8r-xjwq-4w92
GHSA-gg8r-xjwq-4w92 https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/tinymce/tinymce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/tinymce/tinymce/commit/6923d85eba6de3e08ebc9c5a387b5abdaa21150e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/tinymce/tinymce/commit/8bb2d2646d4e1a718fce61a775fa22e9d317b32d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-23494
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixes
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixes
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.tiny.cloud/docs/tinymce/6/file-image-upload/#images_upload_handler
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.83318
EPSS Score 0.01849
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T22:16:32.640174+00:00 EPSS Importer Import https://epss.cyentia.com/epss_scores-current.csv.gz 38.6.0