Approved changes feed: RSS · Atom
cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Tiny (dd5d22cd-1d38-5315-acbe-c292ddd3048d) |
|---|---|
| Product | Tinymce (148a00b0-8406-59ce-8c30-2db820d77841) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/tinymce |
purl2cpe | 2026-06-01 10:14:22.782190 |
pkg:deb/ubuntu/tinymce |
purl2cpe | 2026-06-01 10:14:22.782193 |
pkg:github/tinymce/tinymce |
purl2cpe | 2026-06-01 10:14:22.782194 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-29881 |
vulnerable | 2026-06-08 06:33:29.485101 |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
MEDIUM (4.3)
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.
Published: 2024-03-26T13:31:15.375Z
Updated: 2024-08-02T17:59:24.301Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29203 |
vulnerable | 2026-06-08 06:33:28.970135 |
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
MEDIUM (4.3)
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.
Published: 2024-03-26T13:23:53.673Z
Updated: 2024-08-06T14:37:35.656Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-21911 |
vulnerable | 2026-06-08 06:29:32.587884 |
Cross-site scripting vulnerability in TinyMCE
TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
Published: 2024-01-03T15:59:00.305Z
Updated: 2026-07-14T22:54:37.209Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-21910 |
vulnerable | 2026-06-08 06:29:32.587023 |
Cross-site scripting vulnerability in TinyMCE plugins
TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.
Published: 2024-01-03T15:55:27.061Z
Updated: 2026-07-14T22:54:36.517Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-21908 |
vulnerable | 2026-06-08 06:29:32.584117 |
Cross-site scripting vulnerability in TinyMCE
TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
Published: 2024-01-03T15:38:09.664Z
Updated: 2026-07-14T22:54:35.126Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48219 |
vulnerable | 2026-06-08 06:14:26.147645 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45819 |
vulnerable | 2026-06-08 06:12:43.404656 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45818 |
vulnerable | 2026-06-08 06:12:43.403843 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23494 |
vulnerable | 2026-06-08 05:40:57.641262 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-17480 |
vulnerable | 2026-06-08 05:20:56.574814 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12648 |
vulnerable | 2026-06-08 05:17:58.678926 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-1010091 |
vulnerable | 2026-06-08 05:12:21.598281 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.