CVE-2026-66395

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66395

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66395

SiYuan Desktop before v3.7.2 is affected by a reflected XSS in the bazaar plugin readme handler that enables RCE via a crafted siyuan:// deep link. An attacker can inject HTML payloads through the plugin name parameter, which render with insertAdjacentHTML in an insecure Electron renderer and gra...

EUVD-2026-49328

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

PT-2026-64996

Name of the Vulnerable Software and Affected Versions SiYuan desktop versions prior to 3.7.2 Description A reflected cross-site scripting issue exists in the bazaar plugin readme handler. An attacker can execute arbitrary code by crafting a malicious siyuan:// deep link. By injecting HTML payload...

CVE-2023-39156

A cross-site request forgery CSRF vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags...

CSRF vulnerability in Bazaar Plugin

Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete previously created Bazaar SCM tags...

CVE-2023-39156

A cross-site request forgery CSRF vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags...

CVE-2023-39156

A cross-site request forgery CSRF vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags...

CVE-2023-39156

A cross-site request forgery CSRF vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags...

CVE-2023-39156

CVE-2023-39156 is a CSRF vulnerability in Jenkins Bazaar Plugin 1.22 and earlier. The issue arises because the plugin does not require POST requests on a specific HTTP endpoint, allowing an attacker to delete previously created Bazaar SCM tags. Impact is limited to the ability to delete tags; no ...

CVE-2023-39156

A cross-site request forgery CSRF vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags...

Jenkins Bazaar Plugin 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-26813 · Jenkins · Jenkins Bazaar Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Bazaar Plugin versions 1.22 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete previously created Bazaar SCM tags. This issue arises because the plugin does not require POST requests fo...