Skip to content
OpenAdvisories

Package · npm

joplin

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.1
    CVE-2023-37299

    Joplin Cross-site Scripting vulnerability

    Joplin before 2.11.5 allows XSS via an AREA element of an image map.

    joplin npm
  • Medium 6.1
    CVE-2023-37298

    Joplin Cross-site Scripting vulnerability

    Joplin before 2.11.5 allows XSS via a USE element in an SVG document.

    joplin npm
  • Medium 6.1
    CVE-2022-45598

    Joplin Desktop App vulnerable to Cross-site Scripting

    Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.

    joplin npm
  • Medium 5.4
    CVE-2021-33295

    Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

    Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.

    joplin npm
  • Medium 5.4
    CVE-2021-23431

    Cross-site Request Forgery (CSRF)

    The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.

    joplin npm
  • Medium 6.1
    CVE-2021-37916

    Joplin vulnerable to Cross-site Scripting in notes

    Joplin before 2.0.9 allows XSS via button and form in the note body.

    joplin npm
  • Medium 6.1
    CVE-2020-28249 Public exploit

    Cross-site scripting in Joplin

    Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

    joplin npm
  • Medium 6.1
    CVE-2020-15930 Public exploit

    Cross-site Scripting in Joplin

    An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

    joplin npm
  • Medium 5.4
    CVE-2020-9038 Public exploit

    Cross-site Scripting in Joplin

    Joplin through 1.0.184 allows Arbitrary File Read via XSS.

    joplin npm
  • Medium 6.1
    CVE-2018-1000534

    Joplin Vulnerable to Cross-site Scripting in Note Content

    Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here h…

    joplin npm