Vulnerabilities

TI-2023-23681 CVE-2023-44141 · GHSA-j32p-mg32-5mfh

Code injection in Takuya Matsuyama Inkdrop

LOW 36

Inkdrop prior to v5.6.0 allows a local attacker to conduct a code injection attack by having a legitimate user open a specially crafted markdown file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00311 Published 2023-10-30 Fixed in v5.6.0 CWE-94

TI-2022-23038 CVE-2022-46603 · GHSA-4jxf-85hh-74pj

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file.

MEDIUM 60

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0102 Published 2023-01-09 No fix listed CWE-79

TI-2022-18180 CVE-2022-38639 · GHSA-462r-wxvm-jvxh

A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to…

LOW 25

A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00508 Published 2022-09-09 No fix listed CWE-79

TI-2021-03971 CVE-2021-20745 · GHSA-fgmm-f4rh-2m84

OS command injection in Takuya Matsuyama Inkdrop

LOW 36

Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00964 Published 2021-06-28 Fixed in v5.3.1 CWE-78

Vulnerabilities

Filters

Code injection in Takuya Matsuyama Inkdrop

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file.

A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to…

OS command injection in Takuya Matsuyama Inkdrop