VulnerabilityModified
CVE-2018-18524
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability.
MEDIUM 6.1EPSS 1.93%
Does this matter?
Lower severity and a low EPSS score (1.93%). Track it; it rarely justifies an emergency change on its own.
Description
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.93% probability · 80th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- evernote/evernote
- Source
- cve@mitre.org
EPSS moved from 3.4% on 21 September 2026 to 1.9% on 27 October 2026.
References
- https://evernote.com/intl/en/security/updatesVendor Advisory
- https://paper.seebug.org/737/Exploit, Third Party Advisory
- https://evernote.com/intl/en/security/updatesVendor Advisory
- https://paper.seebug.org/737/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.