CVE-2020-15930

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/159316/Joplin-1.0.245-Cross-Site-Scripting-Code-Execution.htmlExploit, Third Party Advisory
https://github.com/laurent22/joplin/issues/3552Third Party Advisory
https://github.com/laurent22/joplin/releases/tag/v1.1.4Release Notes, Third Party Advisory
http://packetstormsecurity.com/files/159316/Joplin-1.0.245-Cross-Site-Scripting-Code-Execution.htmlExploit, Third Party Advisory
https://github.com/laurent22/joplin/issues/3552Third Party Advisory
https://github.com/laurent22/joplin/releases/tag/v1.1.4Release Notes, Third Party Advisory

Timeline

Published: Sep 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-159317.5Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain CVE-2020-159328.8Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges.CVE-2020-159335.3A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and be CVE-2020-159347.8An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. m CVE-2020-159354.3A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated a CVE-2020-159364.5A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 CVE-2020-159376.1An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker t CVE-2020-159387.5When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it i CVE-2020-159394.3An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, CVE-2020-15947.8<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An CVE-2020-159405.4An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote CVE-2020-159415.4A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to i