{"id":"GHSA-v27h-j97p-wqmx","aliases":["CVE-2014-5191"],"title":"The Preview plugin in CKEditor allows Cross-site scripting (XSS)","description":"Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","severity":"medium","score":6.9,"published":"2022-05-17T04:08:14.000Z","modified":"2025-02-19T19:27:03.405Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"ckeditor/ckeditor","ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.3"}],"type":"ECOSYSTEM"}],"versions":["4.3.3","4.3.4","4.3.5","4.4.0","4.4.1","4.4.2"],"fixed":["4.4.3"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2014-5191","https://github.com/ckeditor/ckeditor4/commit/b685874c6bc873a76e6e95916c43840a2b7ab08a","https://github.com/ckeditor/ckeditor4-releases","http://ckeditor.com/node/136981"],"sources":[{"name":"OSV","id":"GHSA-v27h-j97p-wqmx","modified":"2025-02-19T19:27:03.405634Z","url":"https://osv.dev/vulnerability/GHSA-v27h-j97p-wqmx"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":6.9}]}