brufdev vulnerabilities

Products

• many notes 1
• many-notes 1

Latest brufdev CVEs

Newest publication first

1. CVE-2026-54053 Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults

   Published 2026-09-17

   Critical·CVSS 9.6

   Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitr...

2. CVE-2025-55474 Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed.

   Published 2025-09-02

   Medium·CVSS 6.1

   Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.