Threats tagged 'ghsa-pxmj-79fq-gv83'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Critical	9.3	CVE-2026-124493SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that Critical9.32026-11-08GCVE DatabaseCVE-2026-124493 SunEditor versions prior to 3.4.0 have a stored cross-site scripting (XSS) vulnerability in the DocumentType constructor. This flaw occurs because header textContent is injected into innerHTML without proper HTML escaping. Attackers can exploit this by storing entity-encoded HTML in h1-h6 headers, which executes JavaScript when editors using document:header mode initialize, potentially leading to session cookie theft. Report on CVE-2026-124493 Vulnerability CWE-79 #ghsa-pxmj-79fq-gv83	GCVE Database	2026-11-08

Page 1 of 1