Home

Description

Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind mapping files or custom headers. Attackers can craft malicious files with embedded JavaScript that execute system commands when opened, enabling remote code execution through mouse interactions or file opening.

PUBLISHED Reserved 2026-01-14 | Published 2026-01-16 | Updated 2026-01-16 | Assigner VulnCheck




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

2020
affected

Credits

TaurusOmar finder

References

www.vulncheck.com/...s/xmind-persistent-cross-site-scripting exploit

www.exploit-db.com/exploits/49827 (ExploitDB-49827) exploit

www.xmind.net/ (Official Xmind Product Homepage) product

imgur.com/a/t96Nxo5 (Proof of Concept Video) exploit

www.vulncheck.com/...s/xmind-persistent-cross-site-scripting (VulnCheck Advisory: Xmind 2020 - Persistent Cross-Site Scripting) third-party-advisory

cve.org (CVE-2021-47844)

nvd.nist.gov (CVE-2021-47844)

Download JSON