https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T00:32:58.129659+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124491 CVE-2026-124491 — SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename 2026-11-11T00:32:58.130660+00:00

Affected: JiHong88 suneditor

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.