Read the docs

CKSource

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

CKSource records in CISA KEV

No CKSource vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ckfinder 4 records MEDIUM Ckeditor 2 records LOW Ckeditor 4 1 record LOW Ckeditor 5 Premium Features 1 record LOW

Records

9 records

TI-2011-04280 CVE-2011-4972 · GHSA-fq9v-xx8v-3p87

Information disclosure in CKSource CKEditor Drupal module

Priority LOW 36

hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01744 Published 2019-11-13 No fix listed CWE-200
TI-2025-12775 CVE-2025-13980 · GHSA-8479-rrmq-2rhw

CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118

Priority LOW 30

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00269 Published 2026-01-28 Fixed in 1.2.10, 1.3.6 +3 CWE-288
TI-2023-04398 CVE-2023-4771 · GHSA-wh5w-82f3-wrxh

Cross-Site Scripting vulnerability in CKSource CKEditor

Priority LOW 29

A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00878 Published 2023-11-16 Fixed in 4.24.0-lts CWE-79
TI-2016-09199 CVE-2016-20023 · GHSA-fv5g-wf76-67g3

Path traversal in CKSource CKFinder

Priority LOW 29

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2025-12-05 Fixed in 2.5.0.1 CWE-23
TI-2024-12289 CVE-2024-13245 · GHSA-2gj6-558v-rq2w

CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

Priority LOW 24

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSI…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00229 Published 2025-01-09 Fixed in 1.0.1 CWE-79
Open these records in search →