Advisories · Technology
laurent22 joplin.
Every CVE that names laurent22 joplin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
- laurent22 joplin
- Authentication bypass
- Weak cryptography or TLS
- CVSS 4.8 Medium
Joplin Server password reset accepts tokens issued for unrelated purposes
- laurent22 joplin
- CWE-620
- CWE-640
- CVSS 4.6 Medium
Joplin whiteboard card rendering allows CSS injection into application chrome
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 8.0 High
Joplin Web Clipper pairing allows cross-origin theft of a permanent API token
- laurent22 joplin
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 4.4 Medium
Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Joplin: Pending share recipients can write items into shared folders before accepting invitations
- laurent22 joplin
- Broken access control
- CVSS 7.4 High
Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
- laurent22 joplin
- Authentication bypass
- CVSS 7.6 High
Joplin: Stored XSS via inline-served note attachment on published shares
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 7.7 High
Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
- laurent22 joplin
- Authentication bypass
- CVSS 6.5 Medium
Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
- laurent22 joplin
- Broken access control
- CVSS 4.3 Medium
Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
- laurent22 joplin
- Path traversal
- CVSS 2.5 Low
Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
- laurent22 joplin
- Information disclosure
- Hard-coded credentials
- CVSS 7.0 High
Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
- laurent22 joplin
- Path traversal
- CWE-20
- CVSS 7.1 High
Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName
- laurent22 joplin
- CWE-345
- CWE-353
- CVSS 5.7 Medium
Joplin Server delta API returns note content after share access is revoked
- laurent22 joplin
- Information disclosure
- Broken access control
- CVSS 5.5 Medium
Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input
- laurent22 joplin
- Denial of service
- CVSS 8.8 High
Privilege escalation in Joplin server via user patch endpoint
- laurent22 joplin
- Broken access control
- CVSS 7.5 High
Joplin Server Vulnerable to Path Traversal
- laurent22 joplin
- Path traversal
- CVSS 7.8 High
Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 7.8 High
Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 3.3 Low
DOM Clobbering leads to temporary DOS in the note viewer in Joplin
- laurent22 joplin
- CWE-20
- CVSS 7.3 High
Lack of validation on openExternal allows 1 click remote code execution in joplin
- laurent22 joplin
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
Joplin has a parsing error leading to Cross-site Scripting (XSS)
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 8.2 High
Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 8.2 High
Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 8.2 High
Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 8.9 High
Arbitrary code execution on click of PDF links in Joplin
- laurent22 joplin
- Code injection