Cksource vulnerabilities
9 vulnerabilities
Known vulnerabilities in Cksource products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Ckfinder4 vulnerabilities
- Ckeditor2 vulnerabilities
- Ckeditor 41 vulnerabilities
- Ckeditor 5 Premium Features1 vulnerabilities
- Ckeditor Drupal Module1 vulnerabilities
CVE-2015-9349cksourceckeditor+1
EPSS score0.91%
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.CVE-2016-20023cksourceckfinderEPSS score0.34%
In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.CVE-2025-63830cksourceckfinderEPSS score0.27%
CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.CVE-2025-13980cksourceckeditor_5_premium_features+1EPSS score0.27%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0 before 1.6.4.CVE-2011-4972ckeditorckeditor+1EPSS score1.74%
hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.CVE-2024-13245cksourceckeditor_4+1EPSS score0.23%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.CVE-2019-15891cksourceckfinderEPSS score1.09%
An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that the application has a built-in bulletproof content sniffing protection.CVE-2019-15862cksourceckfinderEPSS score1.52%
An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the application was configured to accept files only with a defined set of extensions). This affects CKFinder for ASP, CKFinder for ASP.NET, CKFinder for ColdFusion, and CKFinder for PHP.CVE-2023-4771cksourceckeditor+6EPSS score0.88%
A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.