CVE-2021-42227

MEDIUM

KindEditor 4.1-4.1.11 - Cross-Site Scripting via Upload Button Example

Title source: llm
STIX 2.1

Description

Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/kindsoft/kindeditor/issues/336

Scores

CVSS v3 6.1
EPSS 0.0091
EPSS Percentile 55.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
kindsoft/kindeditor 4.1 - 4.1.12
npm/kindeditor 0npm
Published Oct 14, 2021
Tracked Since Feb 18, 2026