Most recent entries from all

DRUPAL-CONTRIB-2024-009

Affected: Packagist:https://packages.drupal.org/8: drupal/ckeditor_lts

The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a [security update](https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS) that on certain configurations may impact the Drupal module that bundles and integrates this code.

The vulnerability is mitigated by the fact it requires:

1. [full-page editing](https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) mode is enabled 2. or CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements) are enabled. 3. An attacker must have a permission with access to the CKEditor instance.

For more information, see CKEditor's security advisory: [CVE-2024-24815](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm): Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

EUVD-2026-209914

fkie_cve-2024-13245

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.

GHSA-2gj6-558v-rq2w

WID-SEC-W-2024-0400 — Drupal: Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.