Skip to contentJoplin Project Joplin vulnerabilities
- joplin project joplinPrivilege escalation in Joplin server via user patch endpointCVE-2025-271348.8 High
- joplin project joplinJoplin Server Vulnerable to Path TraversalCVE-2025-274097.5 High
- joplin project joplinCross-site Scripting in Goto Anything allows arbitrary code execution in JoplinCVE-2025-251877.8 High
- joplin project joplinCross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in JoplinCVE-2025-24028Fix available7.8 High
- joplin project joplinDOM Clobbering leads to temporary DOS in the note viewer in JoplinCVE-2024-556303.3 Low
- joplin project joplinLack of validation on openExternal allows 1 click remote code execution in joplinCVE-2024-532687.3 High
- joplin project joplinRemote Code Execution on click of <a> Link in markdown previewCVE-2024-49362Fix available7.7 High
- joplin project joplinJoplin has a parsing error leading to Cross-site Scripting (XSS)CVE-2024-406439.7 Critical
- joplin project joplinSafe mode Cross-site Scripting (XSS) vulnerability in JoplinCVE-2023-378988.2 High
- joplin project joplinCross-site Scripting (XSS) when pasting HTML into the rich text editor in JoplinCVE-2023-385068.2 High
- joplin project joplinCross site scripting (XSS) when clicking on an untrusted `<map>` link in JoplinCVE-2023-395178.2 High
- joplin project joplinArbitrary code execution on click of PDF links in JoplinCVE-2023-456738.9 High
- joplin project joplinJoplin Cross-site Scripting vulnerabilityCVE-2023-37299Fix available6.1 Medium
- joplin project joplinJoplin Cross-site Scripting vulnerabilityCVE-2023-37298Fix available6.1 Medium
- joplin project joplinJoplin Desktop App vulnerable to Cross-site ScriptingCVE-2022-45598Fix available6.1 Medium
- joplin project joplinJoplin Cross Site Scripting Vulnerability via NOSCRIPT tagsCVE-2021-33295Fix available5.4 Medium
- joplin project joplinJoplin Vulnerable to Code InjectionCVE-2022-23340Fix available9.8 Critical
- joplin project joplinJoplin vulnerable to Cross-site Scripting in notesCVE-2021-37916Fix available6.1 Medium
- joplin project joplinCross-site scripting in JoplinCVE-2020-28249Public exploitFix available6.1 Medium
- joplin project joplinCross-site Scripting in JoplinCVE-2020-15930Public exploitFix available6.1 Medium
- joplin project joplinCross-site Scripting in JoplinCVE-2020-9038Public exploitFix available5.4 Medium
- joplin project joplinJoplin Vulnerable to Cross-site Scripting in Note ContentCVE-2018-1000534Fix available6.1 Medium