WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product ckeditor✕Has a public PoC✕
Overview 7 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
7matches 0in Waratek scope0.0% 0protected0.0% 1exploited14.3% 0CISA KEV0.0% 1EPSS ≥ 0.514.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 7 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 2 28.6% Medium 5 71.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 6 85.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 7 Medium: 5High: 2 not blocked: 7 Working exploit published: 6Exploited: 1
20051 Not applicable1 Medium1 not blocked1 Working exploit published1 20061 Not applicable1 Medium1 not blocked1 Working exploit published1 20070 20080 20092 Not applicable2 High2 not blocked2 Exploited1 Working exploit published1 20100 20110 20121 Not applicable1 Medium1 not blocked1 Working exploit published1 20130 20140 20150 20160 20170 20180 20190 20200 20211 Not applicable1 Medium1 not blocked1 Working exploit published1 20220 20231 Not applicable1 Medium1 not blocked1 Working exploit published1
2005200720092011201320152017201920212023
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-48110 Medium 2023-02-13 Not applicable Working exploit published CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).
CVE-2021-33829 Medium 2021-06-09 Not applicable Working exploit published A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
CVE-2012-4000 Medium 2012-07-12 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters.
CVE-2009-2265 High 2009-07-05 Not applicable Exploited Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.
CVE-2008-6178 High 2009-02-19 Not applicable Working exploit published Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094. NOTE: some of these details are obtained from third party information.
CVE-2006-0658 Medium 2006-02-13 Not applicable Working exploit published Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.
CVE-2005-0613 Medium 2005-02-28 Not applicable Working exploit published Unknown vulnerability in FCKeditor 2.0 RC2, when used with PHP-Nuke, allows remote attackers to upload arbitrary files.