CVE-2018-19048

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.

• CWE-79

• https://github.com/hkglue/simditor_demo.gitExploit, Third Party Advisory
• https://github.com/hkglue/simditor_dom_xss/blob/master/README.mdExploit, Third Party Advisory
• https://github.com/mycolorway/simditor/commit/ef01a643cbb7f8163535d6bfb71135f80ec6a6fdPatch, Third Party Advisory
• https://github.com/mycolorway/simditor/releases/tag/v2.3.22Release Notes, Third Party Advisory
• https://github.com/hkglue/simditor_demo.gitExploit, Third Party Advisory
• https://github.com/hkglue/simditor_dom_xss/blob/master/README.mdExploit, Third Party Advisory
• https://github.com/mycolorway/simditor/commit/ef01a643cbb7f8163535d6bfb71135f80ec6a6fdPatch, Third Party Advisory
• https://github.com/mycolorway/simditor/releases/tag/v2.3.22Release Notes, Third Party Advisory

Published

May 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19042The Media File Manager plugin 1.4.2 for WordPress allows arb…
• CVE-2018-19043The Media File Manager plugin 1.4.2 for WordPress allows arb…
• CVE-2018-19044keepalived 2.0.8 didn't check for pathnames with symlinks wh…
• CVE-2018-19045keepalived 2.0.8 used mode 0666 when creating new temporary …
• CVE-2018-19046keepalived 2.0.8 didn't check for existing plain files when …
• CVE-2018-19047mPDF through 7.1.6, if deployed as a web application that ac…
• CVE-2018-1905IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is …7.1
• CVE-2018-19050MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpasswor…
• CVE-2018-19051MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpasswor…
• CVE-2018-19052An issue was discovered in mod_alias_physical_handler in mod…7.5
• CVE-2018-19053PbootCMS 1.2.2 allows remote attackers to execute arbitrary …
• CVE-2018-19056pandao Editor.md 1.5.0 has DOM XSS via input starting with a…