Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: CKSource Clear all filters
TI-2025-12775 CVE-2025-13980 · GHSA-8479-rrmq-2rhw

CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118

Priority LOW 30

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00269 Published 2026-01-28 Fixed in 1.2.10, 1.3.6 +3 CWE-288
TI-2016-09199 CVE-2016-20023 · GHSA-fv5g-wf76-67g3

Path traversal in CKSource CKFinder

Priority LOW 29

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2025-12-05 Fixed in 2.5.0.1 CWE-23
TI-2024-12289 CVE-2024-13245 · GHSA-2gj6-558v-rq2w

CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

Priority LOW 24

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSI…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00229 Published 2025-01-09 Fixed in 1.0.1 CWE-79
TI-2023-04398 CVE-2023-4771 · GHSA-wh5w-82f3-wrxh

Cross-Site Scripting vulnerability in CKSource CKEditor

Priority LOW 29

A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00878 Published 2023-11-16 Fixed in 4.24.0-lts CWE-79
TI-2011-04280 CVE-2011-4972 · GHSA-fq9v-xx8v-3p87

Information disclosure in CKSource CKEditor Drupal module

Priority LOW 36

hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01744 Published 2019-11-13 No fix listed CWE-200