Tiny records

21 published records for vendor tiny.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 1 · 4.8%
Pre-auth RCE: 0
With a fix record: 81%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

21 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
56Plan	CVE-2011-4908Weaponized	TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.tiny · tinybrowser · CWE-434 Pre-auth File upload	Critical9.8	—	55.8%	Feb 12, 2020
42Plan	CVE-2011-4906Proof of concept	Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.tiny · tinybrowser · CWE-434 Pre-auth File upload	Critical9.8	—	9.6%	Feb 12, 2020
35Monitor	CVE-2021-23562No exploit	Arbitrary File Uploadtiny · plupload · CWE-434 Pre-auth File upload	High8.8	—	1.0%	Dec 3, 2021
35Monitor	CVE-2024-24701No exploit	WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)tiny · setka workflow · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Feb 28, 2024
30Monitor	CVE-2019-10012No exploit	Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a jenzabar · internet campus solution · CWE-434 RCE File upload	High7.5	—	1.6%	Mar 25, 2019
25Monitor	CVE-2019-1010091No exploit	tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.tiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	1.9%	Jul 17, 2019
25Monitor	CVE-2020-12648No exploit	A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configurtiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	1.8%	Aug 14, 2020
24Monitor	CVE-2020-17480No exploit	TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboardtiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	1.2%	Aug 10, 2020
24Monitor	CVE-2024-21911No exploit	Cross-site scripting vulnerability in TinyMCEtiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	1.2%	Jan 3, 2024
24Monitor	CVE-2024-21908No exploit	Cross-site scripting vulnerability in TinyMCEtiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	1.1%	Jan 3, 2024
24Monitor	CVE-2022-23494No exploit	Cross-site scripting vulnerability in TinyMCE alertstiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	1.0%	Dec 8, 2022
24Monitor	CVE-2024-21910No exploit	Cross-site scripting vulnerability in TinyMCE pluginstiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	1.0%	Jan 3, 2024
24Monitor	CVE-2023-48219No exploit	Special characters in unescaped text nodes can trigger mXSS in TinyMCEtiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Nov 15, 2023
24Monitor	CVE-2024-29203No exploit	TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframestiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Mar 26, 2024
24Monitor	CVE-2024-29881No exploit	TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementstiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Mar 26, 2024
24Monitor	CVE-2023-45818No exploit	Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugintiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Oct 19, 2023
24Monitor	CVE-2023-45819No exploit	Cross-site Scripting vulnerability in TinyMCE notificationManager.open APItiny · tinymce · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Oct 19, 2023
21Monitor	CVE-2026-47762No exploit	TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentstiny · tinymce · CWE-79 XSS	Medium5.4	—	0.4%	May 28, 2026
21Monitor	CVE-2026-47759No exploit	TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributestiny · tinymce · CWE-79 XSS	Medium5.4	—	0.4%	May 28, 2026
21Monitor	CVE-2026-47761Proof of concept	TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injectiontiny · tinymce · CWE-79 XSS	Medium5.4	—	0.4%	May 28, 2026
21Monitor	CVE-2026-47760No exploit	TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGstiny · tinymce · CWE-79 RCE XSS	Medium5.4	—	0.3%	May 28, 2026

CVE-2011-4908
56Plan
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
CriticalCVSS 9.8WeaponizedEPSS 56%
- Pre-auth
- File upload
tiny · tinybrowserFeb 12, 2020
CVE-2011-4906
42Plan
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.
CriticalCVSS 9.8Proof of conceptEPSS 10%
- Pre-auth
- File upload
tiny · tinybrowserFeb 12, 2020
CVE-2021-23562
35Monitor
Arbitrary File Upload
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- File upload
tiny · pluploadDec 3, 2021
CVE-2024-24701
35Monitor
WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
tiny · setka workflowFeb 28, 2024
CVE-2019-10012
30Monitor
Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a
HighCVSS 7.5No exploitEPSS 2%
- RCE
- File upload
jenzabar · internet campus solutionMar 25, 2019
CVE-2019-1010091
25Monitor
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.
MediumCVSS 6.1No exploitEPSS 2%
- Pre-auth
- XSS
tiny · tinymceJul 17, 2019
CVE-2020-12648
25Monitor
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configur
MediumCVSS 6.1No exploitEPSS 2%
- Pre-auth
- XSS
tiny · tinymceAug 14, 2020
CVE-2020-17480
24Monitor
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceAug 10, 2020
CVE-2024-21911
24Monitor
Cross-site scripting vulnerability in TinyMCE
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceJan 3, 2024
CVE-2024-21908
24Monitor
Cross-site scripting vulnerability in TinyMCE
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceJan 3, 2024
CVE-2022-23494
24Monitor
Cross-site scripting vulnerability in TinyMCE alerts
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceDec 8, 2022
CVE-2024-21910
24Monitor
Cross-site scripting vulnerability in TinyMCE plugins
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceJan 3, 2024
CVE-2023-48219
24Monitor
Special characters in unescaped text nodes can trigger mXSS in TinyMCE
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceNov 15, 2023
CVE-2024-29203
24Monitor
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceMar 26, 2024
CVE-2024-29881
24Monitor
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceMar 26, 2024
CVE-2023-45818
24Monitor
Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceOct 19, 2023
CVE-2023-45819
24Monitor
Cross-site Scripting vulnerability in TinyMCE notificationManager.open API
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
tiny · tinymceOct 19, 2023
CVE-2026-47762
21Monitor
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
MediumCVSS 5.4No exploitEPSS 0%
- XSS
tiny · tinymceMay 28, 2026
CVE-2026-47759
21Monitor
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
MediumCVSS 5.4No exploitEPSS 0%
- XSS
tiny · tinymceMay 28, 2026
CVE-2026-47761
21Monitor
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
tiny · tinymceMay 28, 2026
CVE-2026-47760
21Monitor
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
MediumCVSS 5.4No exploitEPSS 0%
- RCE
- XSS
tiny · tinymceMay 28, 2026