46 matches found
CVE-2026-32751 SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree MobileFiles.ts renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version Files.ts properly uses escapeHtml for the same...
CVE-2026-32751
SiYuan vulnerability CVE-2026-32751 affects versions 3.6.0 and earlier where the mobile file tree (MobileFiles.ts) renders notebook names with innerHTML without escaping during renamenotebook WebSocket events. This allows an authenticated user who can rename notebooks to inject HTML/JavaScript th...
PT-2026-25826
Name of the Vulnerable Software and Affected Versions SiYuan versions 3.6.0 and below SiYuan versions prior to 3.6.1 Description SiYuan is a personal knowledge management system. The mobile file tree component MobileFiles.ts renders notebook names using innerHTML without proper HTML escaping when...
Markdownify security vulnerabilities
Markdownify is a minimal Markdown editor desktop application built using Electron by Amit Merchant as a personal development project. Version 1.2.0 of Markdownify contains a security vulnerability; this vulnerability stems from stored cross-site scripting in markdown files, which could lead to...
Exploit for CVE-2026-22804
Termix Stored XSS PoC GHSA-m3cv-5hgp-hv35 This repository c...
CVE-2025-56800
Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable...
Malicious Package
Overview @dropbox-photo-viewer/electron-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
MAL-2025-47523 Malicious code in @dropbox-photo-viewer/electron-app (npm)
The package @dropbox-photo-viewer/electron-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0e60f8bd38264b681d07237c310d98471fc7bfc1b9ab2bfabf4258bf01a9ea9 Any computer that has this package installed or running should be...
Markdownify 命令注入漏洞
Markdownify is a minimal Markdown Editor desktop application built on Electron by the individual developer Amit Merchant. A command injection vulnerability exists in Markdownify versions prior to 0.0.2, which stems from a failure to clean up input parameters resulting in command injection that...
CVE-2021-36668
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App...
MAL-2025-215 Malicious code in percy-cake-electron-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84391faa58dbd8fba6583b300874c0f4eeb13fef558586ce912dc3b8d9ba314a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Exploit for Cross-site Scripting in Goanother Another_Redis_Desktop_Manager
Another Redis Desktop Manager PoC A Proof-Of-Concept for CVE-2...
Malicious Package
Overview electron-app-extension is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious code in electron-app-extension (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 60f27dea6e7b4668b7cf3b3005c258d1ca073176e2408e8f977b1c4907577dfa The OpenSSF Package Analysis project identified 'electron-app-extension' @ 1.0.0 npm as malicious. It is considered malicious because: - The...
Markdownify 安全漏洞
Markdownify is a minimal Markdown Editor desktop application built on Electron by the individual developer Amit Merchant. A security vulnerability exists in Markdownify version 1.4.1 that stems from the application not having a CSP policy to properly validate markdown files before rendering their...
CVE-2021-36668
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App...
CVE-2021-36668
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App...
Design/Logic Flaw
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App...
CVE-2021-36668
CVE-2021-36668 concerns a URL injection in Druva’s inSync Electron-based UI for macOS 6.9.0. The vulnerability allows a local attacker to force the app to navigate to an arbitrary URL by manipulating the port parameter, due to issues in the Electron wrapper. Affected software is Driva inSync 6.9....