CVE catalog
CVE-2025-61261
UBUNTU-CVE-2025-61261
- Severity
- Medium · CVSS 5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.29% · Oct 25, 2026
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | ckeditor | pro | 4.4.4+dfsg1-3 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.6+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2ubuntu0.16.04.1~esm2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2ubuntu0.16.04.1~esm3 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 4.9-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.1-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.2-1 | vulnerable |
| Ubuntu | ldap-account-manager | 16.04 | 5.2-1ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.11-2 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-3 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-4 | vulnerable |
| Ubuntu | request-tracker4 | 16.04 | 4.2.12-5 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2ubuntu0.18.04.1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2ubuntu0.18.04.1+esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.5.7+dfsg-2ubuntu0.18.04.1+esm2 | vulnerable |
| Ubuntu | ckeditor3 | 18.04 | 3.6.6.1+dfsg-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 5.7-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 6.1-1 | vulnerable |
| Ubuntu | ldap-account-manager | 18.04 | 6.2-1 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.1-5 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-1 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-2 | vulnerable |
| Ubuntu | request-tracker4 | pro | 4.4.2-2ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.11.1+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1ubuntu0.1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1ubuntu0.1+esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1ubuntu0.1+esm2 | vulnerable |
| Ubuntu | ckeditor3 | 20.04 | 3.6.6.1+dfsg-3 | vulnerable |
| Ubuntu | ckeditor3 | 20.04 | 3.6.6.1+dfsg-4 | vulnerable |
| Ubuntu | ldap-account-manager | 20.04 | 6.7-1 | vulnerable |
| Ubuntu | request-tracker4 | 20.04 | 4.4.3-2 | vulnerable |
| Ubuntu | request-tracker4 | 20.04 | 4.4.3-2+deb10u3build0.20.04.1 | vulnerable |
| Ubuntu | ckeditor3 | 22.04 | 3.6.6.1+dfsg-7 | vulnerable |
| Ubuntu | ldap-account-manager | 22.04 | 7.5-1 | vulnerable |
| Ubuntu | ldap-account-manager | 22.04 | 7.7-1 | vulnerable |
| Ubuntu | request-tracker4 | 22.04 | 4.4.4+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 22.04 | 4.4.4+dfsg-2ubuntu1.22.04.1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.16.0+dfsg-2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.16.2+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.16.2+dfsg-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.16.2+dfsg-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | ckeditor3 | 24.04 | 3.6.6.1+dfsg-7 | vulnerable |
| Ubuntu | ldap-account-manager | 24.04 | 8.3-1 | vulnerable |
| Ubuntu | ldap-account-manager | 24.04 | 8.5-1 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.4+dfsg-2ubuntu1 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.4+dfsg-2ubuntu2 | vulnerable |
| Ubuntu | request-tracker4 | 24.04 | 4.4.7+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2 | vulnerable |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.22.1+dfsg1-2ubuntu0.24.04.1~esm2 | vulnerable |
| Ubuntu | ckeditor | 25.10 | 4.22.1+dfsg1-2ubuntu1 | vulnerable |
| Ubuntu | ckeditor | 25.10 | 4.22.1+dfsg1-2ubuntu1.1 | vulnerable |
| Ubuntu | ldap-account-manager | 25.10 | 9.0-1 | vulnerable |
| Ubuntu | request-tracker4 | 25.10 | 4.4.7+dfsg-4syncable1 | vulnerable |
| Ubuntu | ldap-account-manager | 26.04 | 9.0-1 | vulnerable |
| Ubuntu | ldap-account-manager | 26.04 | 9.0-1build1 | vulnerable |
| Ubuntu | request-tracker4 | 26.04 | 4.4.7+dfsg-4syncable1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: