Browse / Evernote

Evernote

See its reports on the map

Attack surface: 740 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Evernote

• Cross-site Scripting2
• Access Control2
• Server-Side Request Forgery1
• Cross-Site Request Forgery1
• Path Traversal1
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusionServer-Side Request Forgery (SSRF) · critical
   264 votes
2. CSRF leads to account deactivation of usersCross-Site Request Forgery (CSRF) · medium
   $30044 votes
3. 2 click Remote Code execution in Evernote AndroidPath Traversal: '.../...//' · high
   30 votes
4. Non-production Open Database In Combination With XXE Leads To SSRFXML External Entities (XXE) · critical
   25 votes
5. [34.96.80.155] Server Logs Disclosure lead to Information LeakagePrivilege Escalation · low
   $15023 votes
6. Email Verification Bypass by bruteforcing when setting up 2FAImproper Restriction of Authentication Attempts · low
   $15023 votes
7. One Click Code Execution via FileExecution with Unnecessary Privileges · high
   23 votes
8. Reflected XSS in the shared note view on https://evernote.comCross-site Scripting (XSS) - Reflected · medium
   $50018 votes