CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

EUVD-2026-57463

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

EUVD-2024-51984

Malicious code in bioql PyPI...

CVE-2024-53506

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs...

CVE-2024-53506

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs...

CVE-2024-53506

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs...

CVE-2024-53506

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs...

CVE-2024-53506

CVE-2024-53506 affects Siyuan 3.1.11 via the ids array parameter in the /batchGetBlockAttrs API, enabling a SQL injection vulnerability in the affected endpoint. The CVSS 3.1 vector indicates high impact (C/H, I/H, A/H) with a base score of 9.8 and NETWORK attack vector, no privileges required, a...

SiYuan 安全漏洞

SiYuan is a privacy-first personal knowledge management system from SiYuan open source. A security vulnerability exists in SiYuan version 3.1.11, which stems from the ids array parameter of the /batchGetBlockAttrs file containing a SQL injection vulnerability...