CVE-2021-47963
HighSummary
Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application.
Risk Assessment
Attackers can craft malicious markdown files with embedded JavaScript that executes system commands when opened, enabling remote code execution on the victim's computer, posing a serious security threat.
Recommendation
It is recommended to update Anote to the latest version and implement sanitization filters for markdown files to prevent the injection of malicious code.
Related vulnerabilities
- CVE-2026-78082Critical
The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.
- CVE-2026-8323Critical
The Access Control System by Armiya Information Technologies Ltd. Co. contains an open redirect vulnerability to an untrusted site. The issue affects versions before Versiyon 2 and allows faking the source of data.
- CVE-2026-88285Critical
The GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication. Remote clients can retrieve PTZ information and issue PTZ or raw serial commands.
- CVE-2026-88278Critical
The GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection. A captured PasswordDigest token can be replayed for subsequent ONVIF operations.
- CVE-2026-59679Critical
In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), causing attacker-controlled out-of-bounds heap reads and writes.
- CVE-2026-44950Critical
In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), each glyph's bitmap is copied into a single buffer, and existing checks only validate that the source slice (position, length) lies within the source bitmap buffer. They do not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64), resulting in 64000 bytes written into a 64-byte destination buffer — a heap buffer overflow with attacker-controlled content.
- CVE-2026-13745Critical
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.
- CVE-2026-7188Critical
The Access Control System by Armiya Information Technologies Ltd. Co. contains an SQL injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions before Versiyon 2.
- CVE-2026-19583Critical
Velociraptor allows some sensitive artifacts to be gated by additional permissions, e.g. Linux.Sys.BashShell requires EXECVE. However, no such check was implemented for client monitoring artifacts, and there was no requirement that they carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts.
- CVE-2026-18351Critical
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in is_file_type_valid(), which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass. This makes it possible for unauthenticated attackers to upload executable files and achieve remote code execution.
Original NVD description (English source)
Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application. Attackers can craft malicious markdown files with embedded JavaScript that executes system commands when opened, enabling remote code execution on the victim's computer.