Homepage
About Snyk

kindeditor@4.1.10 vulnerabilities

WYSIWYG HTML editor

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the kindeditor package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

kindeditor is a WYSIWYG HTML editor

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization passed into the content1 parameter in demo.jsp.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for kindeditor.

>=0.0.0
  • M
Cross-site Request Forgery (CSRF)

kindeditor is a WYSIWYG HTML editor

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via a malicious HTML file being uploaded to a website that uses google editor. Note: This requires a victim to click on the generated malicious link.

How to fix Cross-site Request Forgery (CSRF)?

There is no fixed version for kindeditor.

*
  • M
Cross-site Scripting (XSS)

kindeditor is a WYSIWYG HTML editor

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via a Google search of inurl:/examples/uploadbutton.html and then uploading a crafted .html file on the website that uses this editor (the file suffix is allowed).

How to fix Cross-site Scripting (XSS)?

There is no fixed version for kindeditor.

*
  • M
Cross-site Scripting (XSS)

kindeditor is a WYSIWYG HTML editor

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an unknown attack vector, affecting the Chinese versions of KindEditor. This can be exploited by an attacker to obtain user cookie information.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for kindeditor.

*
  • M
Cross-site Scripting (XSS)

kindeditor is a WYSIWYG HTML editor

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an unknown attack vector. This can be exploited by an attacker to obtain user cookie information.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for kindeditor.

*
  • H
Directory Traversal

kindeditor is a lightweight, Open Source(LGPL), cross browser, web based WYSIWYG HTML editor.

Affected versions of this package are vulnerable to Directory Traversal Attacks. A malicious user can browse a file or directory in the kindeditor/attached/ folder via the path parameter without authentication.

How to fix Directory Traversal?

There is no fix version for kindeditor.

*
Go back to all versions of this package