Vulnerabilities

Filters

2 selected

22 records

Sort

Vendor: laurent22 Component: Joplin Clear all filters

TI-2025-19991 CVE-2025-27134

Privilege escalation in Joplin server via user patch endpoint

HIGH 73

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02256 Published 2025-04-30 Fixed in 3.3.3 CWE-284

TI-2025-20244 CVE-2025-27409

Joplin Server Vulnerable to Path Traversal

HIGH 72

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0066 Published 2025-04-30 Fixed in 3.3.3 CWE-22

TI-2025-18856 CVE-2025-25187

Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin

HIGH 69

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00478 Published 2025-02-07 Fixed in 3.1.24 CWE-79

TI-2025-17795 CVE-2025-24028

Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin

HIGH 74

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00516 Published 2025-02-07 Fixed in 3.2.12 CWE-79

TI-2024-36919 CVE-2024-55630

DOM Clobbering leads to temporary DOS in the note viewer in Joplin

MEDIUM 58

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00333 Published 2025-02-07 Fixed in 3.2.8 CWE-20

TI-2024-35730 CVE-2024-53268

Lack of validation on openExternal allows 1 click remote code execution in joplin

HIGH 73

Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00769 Published 2024-11-25 Fixed in 3.0.3 CWE-94

TI-2024-32950 CVE-2024-49362 · GHSA-hff8-hjwv-j9q7

Remote Code Execution on click of <a> Link in markdown preview

HIGH 76

Joplin is a free, open source note taking and to-do application.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01065 Published 2024-11-14 Fixed in 3.1, 3.1.0 CWE-94

TI-2024-27054 CVE-2024-40643

Joplin has a parsing error leading to Cross-site Scripting (XSS)

HIGH 75

Joplin is a free, open source note taking and to-do application.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00793 Published 2024-09-09 Fixed in 3.0.15 CWE-79

TI-2023-19331 CVE-2023-37898

Safe mode Cross-site Scripting (XSS) vulnerability in Joplin

HIGH 69

Joplin is a free, open source note taking and to-do application.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00426 Published 2024-06-21 Fixed in 2.12.9 CWE-79

TI-2023-19886 CVE-2023-38506

Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

HIGH 69

Joplin is a free, open source note taking and to-do application.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00422 Published 2024-06-21 Fixed in 2.12.10 CWE-79

TI-2023-20649 CVE-2023-39517

Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin

LOW 36

Joplin is a free, open source note taking and to-do application.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00476 Published 2024-06-21 Fixed in 2.12.8 CWE-79

TI-2023-24472 CVE-2023-45673

Arbitrary code execution on click of PDF links in Joplin

HIGH 80

Joplin is a free, open source note taking and to-do application.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.01028 Published 2024-06-21 Fixed in 2.13.3 CWE-94

TI-2023-18929 CVE-2023-37299 · GHSA-4jjv-p8x9-rrf7

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

LOW 28

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00574 Published 2023-06-30 Fixed in 2.11.5 CWE-79

TI-2023-18928 CVE-2023-37298 · GHSA-7grw-xfx6-qhx6

Joplin before 2.11.5 allows XSS via a USE element in an SVG document.

LOW 28

Joplin before 2.11.5 allows XSS via a USE element in an SVG document.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00574 Published 2023-06-30 Fixed in 2.11.5 CWE-79

TI-2022-22504 CVE-2022-45598 · GHSA-h6c2-879r-jffh

Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker…

LOW 28

Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00452 Published 2023-01-31 Fixed in 2.9.17 CWE-79

TI-2021-12788 CVE-2021-33295 · GHSA-phj8-2p6x-hq5r

Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows…

LOW 26

Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00866 Published 2022-06-16 Fixed in 1.8.5 CWE-79

TI-2022-07450 CVE-2022-23340 · GHSA-8478-53pv-jxvm

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.

MEDIUM 45

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01505 Published 2022-02-08 Fixed in 2.7.1 CWE-94

TI-2021-15676 CVE-2021-37916 · GHSA-mrmf-755g-w2vw

Joplin before 2.0.9 allows XSS via button and form in the note body.

LOW 29

Joplin before 2.0.9 allows XSS via button and form in the note body.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00733 Published 2021-08-02 Fixed in 2.0.9 CWE-79

TI-2020-17158 CVE-2020-28249 · GHSA-q26w-wjj2-22vv

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

LOW 33

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03063 Published 2020-11-06 Fixed in 1.3.11 CWE-79

TI-2020-12543 CVE-2020-15930 · GHSA-cgc7-mwp4-3ccx

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

LOW 34

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04377 Published 2020-09-24 Fixed in 1.1.7 CWE-79

TI-2020-07254 CVE-2020-9038 · GHSA-6r7x-hc8m-985r

Joplin through 1.0.184 allows Arbitrary File Read via XSS.

LOW 31

Joplin through 1.0.184 allows Arbitrary File Read via XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.03566 Published 2020-02-17 Fixed in 1.2.1 CWE-79

TI-2018-15932 CVE-2018-1000534 · GHSA-m6mf-hmrh-ph4j

Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled…

LOW 30

Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - inf…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01505 Published 2018-06-26 Fixed in 1.0.90 CWE-79