CVE-2020-9281

MediumCVSS 6.1/10Last modified Aug 25, 2026

Description

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2020
Last modified: Aug 25, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-92826.5In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting netw CVE-2020-92837.5golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto CVE-2020-92856.8Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attache CVE-2020-92866.5An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions suc CVE-2020-92877.8A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable CVE-2020-92885.4An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site sc CVE-2020-92897.5Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and CVE-2020-92907.8A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable CVE-2020-92917.8An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via e CVE-2020-92929.8An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the Ao CVE-2020-92949.8An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a CVE-2020-92957.5FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running