Cksource
3 CVEs across 5 Cksource products. Browse Cksource vulnerabilities, severities, and proof-of-concept exploits.
Cksource products with known CVEs
Cksource CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-13980 | Medium | 5.3 | 2026-01-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKE… |
CVE-2016-20023 | Medium | 5.0 | 2025-12-05 | In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided. |
CVE-2025-63830 | Medium | 6.1 | 2025-11-14 | CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content. |
CVE-2024-13245 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-… |
CVE-2023-4771 | Medium | 6.1 | 2023-11-16 | A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript cod… |
CVE-2011-4972 | High | 7.5 | 2019-11-13 | hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private… |
CVE-2019-15891 | Medium | 5.3 | 2019-09-26 | An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that th… |
CVE-2019-15862 | High | 7.5 | 2019-09-26 | An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the a… |
CVE-2015-9349 | Medium | 6.1 | 2019-08-27 | The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. |