Xmind vulnerabilities

Products

• Xmind 3

Latest Xmind CVEs

Newest publication first

1. CVE-2026-0777 Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability

   Published 2026-02-20

   High·CVSS 7.8 EPSS 0.36%

   Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xmind. User interaction is required to exploit this vulnerability in that the target must visit a malici...

2. CVE-2021-47844 Xmind 2020 - Persistent Cross-Site Scripting

   Published 2026-01-16

   Medium·CVSS 5.1 EPSS 0.39%

   Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind mapping files or custom headers. Attackers can craft malicious files with embedded JavaScript that execute system commands when opened, enabling remote code execu...

3. CVE-2014-2680 The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.

   Published 2020-01-21

   High·CVSS 8.1 EPSS 1.9%

   The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.