Stefan Esser has reported some vulnerabilities in TinyMCE compressor, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose sensitive information.

1) Some input isn't properly sanitised before being used to view files. This can be exploited to disclose the content of arbitrary files.

2) Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities have been reported in version 1.0.5 and prior.

Solution
Update to version 1.0.6.
Further details available in Customer Area

Provided and/or discovered by
Stefan Esser, Hardened-PHP Project

Original Advisory
http://www.hardened-php.net/advisory_262005.111.html

Deep Links
Links available in Customer Area