CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser

• CWE-79

• https://burninatorsec.blogspot.com/2021/04/cve-2021-3163-xss-slab-quill-js.htmlExploit, Third Party Advisory
• https://github.com/quilljs/quill/issues/3273Broken Link, Issue Tracking, Third Party Advisory
• https://github.com/quilljs/quill/issues/3364Exploit, Issue Tracking, Third Party Advisory
• https://quilljs.comProduct
• https://burninatorsec.blogspot.com/2021/04/cve-2021-3163-xss-slab-quill-js.htmlExploit, Third Party Advisory
• https://github.com/quilljs/quill/issues/3273Broken Link, Issue Tracking, Third Party Advisory
• https://github.com/quilljs/quill/issues/3364Exploit, Issue Tracking, Third Party Advisory
• https://quilljs.comProduct

Published

Apr 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31616Insufficient length checks in the ShapeShift KeepKey hardwar…8.8
• CVE-2021-31617In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2…9.8
• CVE-2021-31618Apache HTTP Server protocol handler for the HTTP/2 protocol …7.5
• CVE-2021-3162Docker Desktop Community before 2.5.0.0 on macOS mishandles …7.8
• CVE-2021-31624Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.…8.8
• CVE-2021-31627Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.…8.8
• CVE-2021-31630Command Injection in Open PLC Webserver v3 allows remote att…8.8
• CVE-2021-31631b2evolution CMS v7.2.3 was discovered to contain a Cross-Sit…8.8
• CVE-2021-31632b2evolution CMS v7.2.3 was discovered to contain a SQL injec…9.8
• CVE-2021-31635Server-Side Template Injection (SSTI) vulnerability in jFina…9.8
• CVE-2021-31637An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.…7.8
• CVE-2021-3164ChurchRota 2.6.4 is vulnerable to authenticated remote code …8.8