CVE-2021-47840

Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers can upload specially crafted markdown files with embedded JavaScript that execute when opened, potentially enabling remote code execution on the victim's system.

Score

CVSS 3.1 7.2 High

Status

Deferred - disclosure@vulncheck.com

Published

2026-01-16

Last modified

2026-01-16

Weaknesses

CWE-79

Affected products

• Moeditor (Moeditor)

References

• https://imgur.com/a/UdP4JaX
• https://moeditor.js.org/
• https://www.exploit-db.com/exploits/49830
• https://www.vulncheck.com/advisories/moeditor-persistent-cross-site-scripting