CVE-2021-37695

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-376966.5tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user CVE-2021-376976.5tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user CVE-2021-376987.5Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2021-376996.1Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths coul CVE-2021-37707.8vim is vulnerable to Heap-based Buffer Overflow CVE-2021-377006.1@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste CVE-2021-377018.6The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code ex CVE-2021-377028.8Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. CVE-2021-377034.3Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a CVE-2021-377044.3PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and CVE-2021-3770510.0OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization ch CVE-2021-377069.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD