QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2012-4230

Back to search

CVE-2012-4230

Published: Apr 25, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.

VendorProductVersions

n/a

n/a

affected
n/a

References

tinymce-htmlentities-xss(82744)
vdb-entry
x_refsource_XF
20130311 XSS Vulnerability in TinyMCE
mailing-list
x_refsource_FULLDISC
91130
vdb-entry
x_refsource_OSVDB
58424
vdb-entry
x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now