CVE-2026-124491mediumCWE-79

CVE-2026-124491: fallo de gravedad media en JiHong88 suneditor

SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear suneditor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.2%
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Productos afectados
JiHong88 · suneditor
CVEs relacionadas — JiHong88 suneditor

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54606HIGHSunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe EmbedEPSS 0.6%CVE-2026-59167CRITICALSunEditor: Critical XSS vulnerability - sanitizer bypassEPSS 0.5%CVE-2026-124494CRITICALSunEditor before 3.4.0 Stored XSS via : Entity Sanitizer BypassEPSS 0.3%CVE-2026-124493CRITICALSunEditor before 3.4.0 Stored XSS via DocumentType Header textContentEPSS 0.3%CVE-2026-124492HIGHSunEditor before 3.4.0 Stored XSS via Link Modal Bookmark ListEPSS 0.2%