CVE-2018-13339

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.

• CWE-79

• https://github.com/TylerGarlick/angular-redactor/issues/77Exploit, Third Party Advisory
• https://github.com/gleez/cms/issues/796Exploit, Third Party Advisory
• https://github.com/TylerGarlick/angular-redactor/issues/77Exploit, Third Party Advisory
• https://github.com/gleez/cms/issues/796Exploit, Third Party Advisory

Published

Jul 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13333Cross-site scripting in File Manager in TerraMaster TOS vers…
• CVE-2018-13334Cross-site scripting in handle.php in TerraMaster TOS versio…
• CVE-2018-13335Cross-site scripting in Control Panel in TerraMaster TOS ver…
• CVE-2018-13336System command injection in ajaxdata.php in TerraMaster TOS …
• CVE-2018-13337Session Fixation in the web application for TerraMaster TOS …
• CVE-2018-13338System command injection in ajaxdata.php in TerraMaster TOS …
• CVE-2018-1334In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, w…
• CVE-2018-13340Gleez CMS 1.2.0 has CSRF, as demonstrated by a /page/add req…
• CVE-2018-13341Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC…
• CVE-2018-13342The server API in the Anda app relies on hardcoded credentia…
• CVE-2018-13346The mpatch_apply function in mpatch.c in Mercurial before 4.…
• CVE-2018-13347mpatch.c in Mercurial before 4.6.1 mishandles integer additi…