Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Leanote records in CISA KEVNo Leanote vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 45
Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01913 · Published 2020-09-30 · No fix listed CWE-79
Priority MEDIUM 45
Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01913 · Published 2020-09-30 · No fix listed CWE-79
Priority LOW 29
Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01061 · Published 2022-03-28 · No fix listed CWE-79
Priority LOW 29
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2018-10-22 · No fix listed CWE-79
Priority LOW 29
Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00836 · Published 2018-01-03 · No fix listed CWE-79
Priority LOW 28
A vulnerability, which was classified as problematic, has been found in leanote 2.6.1.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00563 · Published 2022-12-21 · No fix listed CWE-79
Priority LOW 28
Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00624 · Published 2019-07-11 · No fix listed CWE-79
THREATIST.IORead the docs