medium6.1
CVE-2021-43721
Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note.
Impact
Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();>
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Leanote | Leanote | Version 2.7.0 |