CVE-2021-47844mediumCWE-79

CVE-2021-47844: medium-severity vulnerability in Xmind

Xmind 2020 - Persistent Cross-Site Scripting

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.4%
exploitation probability
0.4%top 69% of all CVEs
observed exploitation
nono source reports it
Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind mapping files or custom headers. Attackers can craft malicious files with embedded JavaScript that execute system commands when opened, enabling remote code execution through mouse interactions or file opening.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
Xmind · Xmind
Related CVEs — Xmind

In the same product, most dangerous first.

CVE-2026-0777HIGHXmind Attachment Insufficient UI Warning Remote Code Execution VulnerabilityEPSS 0.3%
References
https://imgur.com/a/t96Nxo5https://www.exploit-db.com/exploits/49827https://www.vulncheck.com/advisories/xmind-persistent-cross-site-scriptinghttps://www.xmind.net/