enchant97 vulnerabilities

Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

enchant97 · note-mark

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

enchant97 · note-mark

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

enchant97 · note-mark

Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

enchant97 · note-mark

Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

enchant97 · note-mark

Note Mark: OIDC-registered users authenticated by submitting password "null"

enchant97 · note-mark

Note Mark has Broken Access Control on Asset Download

enchant97 · note-mark

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

enchant97 · note-mark

Note Mark has Stored XSS via Unrestricted Asset Upload

enchant97 · note-mark

Note Mark has a stored XSS in the note link href attribute

enchant97 · note-mark