Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
351 results · page 4 of 8
Aug 26, 2025Firecrawl turns entire websites into LLM-ready markdown or structured data.CVE-2025-57818 · Other software · firecrawl · reported by GitHubMedium 6.3
Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.
- Product
- firecrawl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS).CVE-2025-7969 · Other software · markdown-it · reported by help@fluidattacks.comMedium 6.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not consider this issue to be a vulnerability.
- Product
- markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 19, 2025Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.CVE-2025-54881 · Other software · mermaid-js · reported by GitHubMedium 5.3
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.CVE-2025-54880 · Other software · mermaid-js · reported by GitHubMedium 5.1
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.CVE-2025-50738 · Other software · Usememos · reported by MITRECritical 9.8
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user's IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.
- Product
- Memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component.CVE-2025-54075 · Other software · nuxt-modules · reported by GitHubHigh 8.3
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `<base href="https://attacker.tld">` element. The `<base>` tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Version 0.17.2 contains a fix for the issue.
- Product
- mdc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app.CVE-2025-53833 · Other software · saleem-hadad · reported by GitHubCritical 10
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
- Product
- larecipe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function.CVE-2025-5276 · Other software · reported by report@snyk.ioMedium 6.9
Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests and read the responses to attacker-controlled URLs, potentially leaking sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file toolCVE-2025-5273 · Other software · reported by report@snyk.ioMedium 6.9
Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file tool. An attacker can craft a prompt that, once accessed by the MCP host, will allow it to read arbitrary files from the host running the server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025league/commonmark is a PHP Markdown parser.CVE-2025-46734 · Other software · thephpleague · reported by GitHubMedium 6.4
league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
- Product
- commonmark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown.CVE-2025-46558 · Other software · xwiki-contrib · reported by GitHubCritical 9
XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting (XSS) through HTML. In particular, using Markdown syntax, it's possible for any user to embed Javascript code that will then be executed on the browser of any other user visiting either the document or the comment that contains it. In the instance that this code is executed by a user with admins or programming rights, this issue compromises the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in version 8.9.
- Product
- syntax-markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2025python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>.CVE-2025-46656 · Other software · python-markdownify · reported by MITRELow 2.9
python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consumption.
- Product
- python-markdownify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025External Markdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46445 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through <= 0.0.1.
- Product
- External Markdown
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update External Markdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 20, 2025QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.CVE-2025-43954 · Other software · Quasar · reported by MITREMedium 4.9
QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.
- Product
- QMarkdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$.CVE-2025-3246 · Other software · GitHub · reported by product-cna@github.comHigh 8.6
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and privileged user interaction with the malicious elements. This vulnerability affected version 3.16.1 of GitHub Enterprise Server and was fixed in version 3.16.2. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter.CVE-2025-3512 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Medium 4.8
There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orgopenwall.com
Apr 10, 2025HedgeDoc is an open source, real-time, collaborative, markdown notes application.CVE-2025-32391 · Other software · hedgedoc · reported by GitHubMedium 6.4
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the possibility of XSS when opened in a new tab instead of the editor itself. The XSS is possible by exploiting the JSONP capabilities of GitHub Gist embeddings. Only instances with the local filesystem upload backend or special configurations, where the uploads are served from the same domain as HedgeDoc, are vulnerable. This vulnerability is fixed in 1.10.3. When upgrading to HedgeDoc 1.10.3 is not possible, instance owners could add the following headers for all routes under /uploads as a first-countermeasure: Content-Disposition: attachment and Content-Security-Policy: default-src 'none'. Additionally, the external URLs in the script-src attribute of the Content-Security-Policy header should be removed.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025WP Editor.md – The Perfect WordPress Markdown Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31035 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through <= 10.2.1.
- Product
- WP Editor.md – The Perfect WordPress Markdown Editor
- Affected
- up to 10.2.1
- What to do
- Affects up to 10.2.1. Update WP Editor.md – The Perfect WordPress Markdown Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication.CVE-2024-7983 · Other software · open-webui · reported by security@huntr.devHigh 7.5
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() APCVE-2024-11031 · Other software · binary-husky · reported by security@huntr.devHigh 7.5
In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API. This vulnerability is exploited through the HotReload(Markdown翻译中) plugin function, which allows downloading arbitrary web hosts by only checking if the link starts with 'http'. Attackers can exploit this vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources.
- Product
- binary-husky/gpt_academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sanitized when previewinCVE-2024-54160 · Other software · LF Projects · reported by MITREMedium 6.4
dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sanitized when previewing a header or footer.
- Product
- OpenSearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component.CVE-2025-24981 · Other software · nuxt-modules · reported by GitHubCritical 9.3
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the `javascript:` protocol scheme in the URL. The parsing logic implement in `props.ts` maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like `javascript:` and others. These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. Users who consume this library and perform markdown parsing from unvalidated sources could result in rendering vulnerable XSS anchor links. This vulnerability has been addressed in version 0.13.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mdc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown.CVE-2024-56510 · Other software · marp-team · reported by GitHubMedium 5.3
@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.
- Product
- marp-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2024ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true.CVE-2024-56082 · Other software · reported by MITRELow 3.5
ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.CVE-2024-48463 · Other software · usebruno · reported by MITREMedium 6.5
Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.
- Product
- bruno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elementsCVE-2024-50582 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering ruleCVE-2024-50580 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2024HTML2Markdown is a Javascript implementation for converting HTML to Markdown text.CVE-2020-26307 · Other software · kates · reported by GitHubHigh 8.7
HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.
- Product
- html2markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Oct 15, 2024The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML.CVE-2024-44337 · Other software · reported by MITREMedium 5.1
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization.CVE-2024-21535 · Other software · markdown-to-jsx · reported by report@snyk.ioMedium 6.1
Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.
- Product
- markdown-to-jsx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Sep 2, 2024HedgeDoc is an open source, real-time, collaborative, markdown notes application.CVE-2024-45308 · Other software · hedgedoc · reported by GitHubMedium 6.5
HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the new one. When the freeURL feature is enabled (by setting the `allowFreeURL` config option or the `CMD_ALLOW_FREEURL` environment variable to `true`), any user with the appropriate permissions can create a note with an arbitrary alias, e.g. by accessing it in the browser. When MySQL or MariaDB are used, it is possible to create a new note with an alias that matches the lower-cased ID of a different note. HedgeDoc then always presents the new note to users, as these databases perform case-insensitive matching and the lower-cased alias is found first. This issue only affects HedgeDoc instances that use MySQL or MariaDB. Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note. Attackers could use this issue to present a manipulated c
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows CVE-2024-6585 · Other software · Lightdash · reported by mandiant-cve@google.comMedium 5.4
Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user’s session with the application.
- Product
- Lightdash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0.CVE-2024-7739 · Other software · yzane · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- vscode-markdown-pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0.CVE-2024-7738 · Other software · yzane · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- vscode-markdown-pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.CVE-2024-41482 · Other software · Typora · reported by MITREMedium 6.1
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.CVE-2024-41481 · Other software · Typora · reported by MITREMedium 6.1
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024Note Mark is a web-based Markdown notes app.CVE-2024-41819 · Other software · enchant97 · reported by GitHubHigh 8.7
Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1.
- Product
- note-mark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024CodiMD allows realtime collaborative markdown notes on all platforms.CVE-2024-38354 · Other software · hackmdio · reported by GitHubHigh 8.1
CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4.
- Product
- codimd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024CodiMD allows realtime collaborative markdown notes on all platforms.CVE-2024-38353 · Other software · hackmdio · reported by GitHubMedium 5.3
CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased. This vulnerability is fixed in 2.5.4.
- Product
- codimd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2024ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrCVE-2024-38527 · Other software · mermaid-js · reported by GitHubMedium 5.4
ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as `**` for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS. This puts existing applications that use ZenUML unsandboxed at risk of arbitrary JavaScript execution when rendering user-controlled diagrams. This vulnerability was patched in version 3.23.25,
- Product
- zenuml-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uCVE-2024-33300 · Other software · typora · reported by MITREHigh 7.3
Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uploading Markdown files.
- Product
- typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/publicCVE-2024-28715 · Other software · Html-js · reported by MITREHigh 8.8
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2.CVE-2024-2319 · Other software · Django MarkdownX · reported by cve-coordination@incibe.esMedium 5.4
Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially crafted JavaScript payload in the upload functionality due to lack of proper sanitisation of JavaScript elements.
- Product
- Django MarkdownX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.CVE-2024-22891 · Other software · nteract · reported by MITRECritical 9.8
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.
- Product
- nteract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleCVE-2024-22370 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 26, 2023Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/CVE-2023-50175 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior CVE-2023-45737 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.CVE-2023-28873 · Other software · Seafile · reported by MITREMedium 5.4
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanual.seafile.com
Nov 5, 2023Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.CVE-2023-47258 · Other software · Redmine · reported by MITREMedium 6.1
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.
- Product
- Redmine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredmine.orgredmine.org
Oct 30, 2023Inkdrop prior to v5.6.0 allows a local attacker to conduct a code injection attack by having a legitimate user open a specially crafted markdown file.CVE-2023-44141 · Other software · Takuya Matsuyama · reported by vultures@jpcert.or.jpHigh 7.8
Inkdrop prior to v5.6.0 allows a local attacker to conduct a code injection attack by having a legitimate user open a specially crafted markdown file.
- Product
- Inkdrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.inkdrop.appjvn.jp
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.