CVE-2009-2324: Fckeditor

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory.

Affected products

• Fckeditor Fckeditor: up to and including 2.6.4; version 2.0 only; version 2.0_fc only; version 2.0_rc2 only; version 2.0rc2 only; version 2.0rc3 only; …

Published 2009-07-05. Last modified 2026-06-16.