VYPR
← All advisories
Medium severity5.4NVD Advisory· Published May 19, 2019· Updated Jun 17, 2026

CVE-2019-12184

CVE-2019-12184

Description

There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.

Affected products

3
  • Boostio/Boostnote2 versions
    cpe:2.3:a:boostio:boostnote:0.11.15:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:boostio:boostnote:0.11.15:*:*:*:*:*:*:*
    • (no CPE)range: =0.11.15
  • BoostIO/Boostnotedescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.