Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2025-71465

@kolkov/angular-editor before 3.0.3 XSS via refreshView()

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Kolkov
Products
Angular-editor
CVE-2025-71464

@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Kolkov
Products
Angular-editor