CVE-2014-4037 Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier allows remote attackers to inject arbitra...
MediumCVSS 4.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier allows remote attackers to inject arbitrary web script or HTML via an array key in the textinputs[] parameter, a different issue than CVE-2012-4000.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ckeditor fckeditor | <= 2.6.10 | No fix listed |
References
- ckeditor.com patch vendor-advisory
- packetstormsecurity.com exploit
- 1030413 vdb-entry