Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HJoplinapp Joplin
APPJoplinapp2.8.8
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XSS
CWE
Powiązane podatności
CVE-2026-22810HIGH8.2ten sam produkt
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Vers...
CVE-2022-40277HIGH7.8ten sam produkt
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that ope...
CVE-2021-23431MEDIUM5.4ten sam produkt
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks...