Sploitus

37 exploited vulnerabilities in Tinymce

Vulnerabilities with publicly known exploits

Vendors
Orchard, Tinymce, Joplin, Node.Js, Joomla, Thorsten Rinne
With known exploits
37
Affected Orchardproject Orchard versions
< 1.10
Affected Tiny Tinymce versions
< 5.11.1, 7.9.3, 8.5.1, 5.10.9, 6.7.3, 5.10.8, 6.7.1
Affected Tiny Tinybrowser versions
< 1.5.13
Affected Phpletter Ajax File And Image Manager versions
≤ 1.0, 0.5, 0.5.5, 0.5.7, 0.6, 0.6.12, 0.7.8, 0.7.10, 0.8, 0.8.8, 0.8.9, 0.8.24, 0.9
Affected Phpmyfaq versions
= 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.7.0
Affected Tinymce versions
≤ 1.4.1, 3.5.8
Affected Cmsmadesimple Cms Made Simple versions
≤ 1.2.2
Affected Isic.lk Project Isic.lk versions
≤ 2018-02-13

Vulnerabilities with exploits

Highest CVSS first — 11 of these already have exploit code on Sploitus

CVE-2020-29592
CVSS 9.8 CRITICAL 2021-04-14FIX AVAILABLE
CVE-2026-47762
CVSS 8.7 HIGH 2026-05-28FIX AVAILABLE
CVE-2026-47761
CVSS 8.7 HIGH 2026-05-28FIX AVAILABLE
CVE-2026-47760
CVSS 8.7 HIGH 2026-05-28FIX AVAILABLE
CVE-2026-47759
CVSS 8.7 HIGH 2026-05-28FIX AVAILABLE
CVE-2023-38506
CVSS 8.2 HIGH 2024-06-21FIX AVAILABLE
CVE-2011-4906 1 exploit
CVSS 7.5 HIGH 2020-02-12FIX AVAILABLE
Joomla! 1.5.12 TinyMCE - Remote Code Execution (via Arbitrary File Upload)
CVE-2011-4825 11 exploits
CVSS 7.5 HIGH 2011-12-15FIX AVAILABLE
Log1 CMS 2.0 RCELog1 CMS writeInfo() PHP Code Injection
CVE-2007-6656 1 exploit
CVSS 7.5 HIGH 2008-01-04
CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
CVE-2022-30529
CVSS 7.2 HIGH 2022-11-22FIX AVAILABLE
CVE-2025-62418
CVSS 6.9 MEDIUM 2025-10-16FIX AVAILABLE
CVE-2010-5281 1 exploit
CVSS 6.8 MEDIUM 2012-11-26FIX AVAILABLE
iBrowser Plugin 1.4.1 - 'lang' Local File Inclusion
CVE-2023-30943 3 exploits
CVSS 6.5 MEDIUM 2023-04-19FIX AVAILABLE
Exploit for External Control of File Name or Path in MoodleExploit for External Control of File Name or Path in Moodle
CVE-2012-1467 2 exploits
CVSS 6.5 MEDIUM 2012-09-06FIX AVAILABLE
Open Journal Systems 2.3.6 XSS / File Manipulation / Shell UploadOpen Journal Systems (OJS) 2.3.6 - 'rfiles.php' Traversal Arbitrary File Manipulation
CVE-2024-38357
CVSS 6.4 MEDIUM 2024-06-19FIX AVAILABLE
CVE-2024-38356
CVSS 6.4 MEDIUM 2024-06-19FIX AVAILABLE
CVE-2024-29881
CVSS 6.1 MEDIUM 2024-03-26FIX AVAILABLE
CVE-2024-29203
CVSS 6.1 MEDIUM 2024-03-26FIX AVAILABLE
CVE-2023-48219
CVSS 6.1 MEDIUM 2023-11-15FIX AVAILABLE
CVE-2023-45819
CVSS 6.1 MEDIUM 2023-10-19FIX AVAILABLE
CVE-2023-45818
CVSS 6.1 MEDIUM 2023-10-19FIX AVAILABLE
CVE-2024-21911
CVSS 6.1 MEDIUM 2021-01-06FIX AVAILABLE
CVE-2024-21910
CVSS 6.1 MEDIUM 2021-11-02FIX AVAILABLE
CVE-2024-21908
CVSS 6.1 MEDIUM 2021-10-22FIX AVAILABLE
CVE-2020-17480
CVSS 6.1 MEDIUM 2020-01-30FIX AVAILABLE
CVE-2019-1010091
CVSS 6.1 MEDIUM 2019-07-17FIX AVAILABLE
CVE-2022-23494
CVSS 5.4 MEDIUM 2022-12-08FIX AVAILABLE
CVE-2020-5809
CVSS 5.4 MEDIUM 2020-12-30FIX AVAILABLE
CVE-2013-4791
CVSS 5.4 MEDIUM 2020-02-13FIX AVAILABLE
CVE-2011-5147 1 exploit
CVSS 5.0 MEDIUM 2012-08-31
FreeWebShop 2.2.9 R2 - 'ajax_save_name.php' Remote Code Execution
CVE-2011-3718
CVSS 5.0 MEDIUM 2011-09-23FIX AVAILABLE
CVE-2008-7212
CVSS 5.0 MEDIUM 2009-09-11FIX AVAILABLE
CVE-2021-35955
CVSS 4.8 MEDIUM 2021-08-12FIX AVAILABLE
CVE-2013-3630 9 exploits
CVSS 4.6 MEDIUM 2013-11-01FIX AVAILABLE
Moodle Authenticated Spelling Binary Remote Code Execution ExploitMoodle SpellChecker Path Authenticated Remote Command Execution Exploit
CVE-2012-4230 1 exploit
CVSS 4.3 MEDIUM 2014-04-25FIX AVAILABLE
TinyMCE 3.5.8 Cross Site Scripting
CVE-2012-1469 3 exploits
CVSS 4.3 MEDIUM 2012-09-06FIX AVAILABLE
Open Journal Systems 2.3.6 XSS / File Manipulation / Shell UploadOpen Journal Systems (OJS) 2.3.6 - 'index.php?authors[][url]' Cross-Site Scripting
CVE-2009-2043 1 exploit
CVSS 4.3 MEDIUM 2009-06-12FIX AVAILABLE
Mozilla Firefox 3.0.10 - 'nsViewManager.cpp' Denial of Service