CVE-2021-47963

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application. Attackers can craft malicious markdown files with embedded JavaScript that executes system commands when opened, enabling remote code execution on the victim's computer.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2021

CVE-2021-479648.8Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploa CVE-2021-479659.8WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows a CVE-2021-479668.2PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that CVE-2021-479676.1PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScrip CVE-2021-479686.4Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by subm CVE-2021-479697.5Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long charac CVE-2021-479707.5Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by creating notes with excessive CVE-2021-479717.5My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long char CVE-2021-479727.5Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the application by creating not CVE-2021-479737.5Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively l CVE-2021-479747.8VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services that allows loc CVE-2021-479757.2WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script