CVE-2026-82653

SiYuan before v3.8.1 is affected by a stored cross-site scripting (XSS) vulnerability in the confirmDialog() function. Unescaped package names and notebook names are interpolated directly into innerHTML assignments, allowing attackers to submit malicious bazaar packages with HTML/script payloads ...

EUVD-2026-68239

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

PT-2026-83579

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2023-21251

In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21251

In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

Input validation

In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21251

In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...

PT-2023-18037 · Google · Android

Name of the Vulnerable Software and Affected Versions: ConfirmDialog.java affected versions not specified Description: The issue is related to improper input validation in the onCreate method of ConfirmDialog.java, allowing a possible connection to VNP without the user's consent. This could lead ...