29 matches found
SUSE CVE-2026-59834
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNI...
CVE-2026-87807
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...
CVE-2026-87810
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...
EUVD-2026-74836
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...
CVE-2026-87810 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...
CVE-2026-87810 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...
CVE-2026-87810
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint. While the endpoint filters private blocks from returned results, it returns unfiltered match counts , allowing unauthenticated publish-mode readers to submit arbitrary searc...
CVE-2026-87810 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...
CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...
EUVD-2026-74834
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...
CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...
CVE-2026-87808
SiYuan versions prior to v3.8.2 contain an incomplete fix for CVE-2026-32767. The POST /api/search/fullTextSearchBlock endpoint, when invoked with method=2, forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a resu...
CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...
CVE-2026-87807 siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...
CVE-2026-87807
siyuan (a self-hosted knowledge management application) versions before v3.8.2 are affected by an SQL injection vulnerability in the fullTextSearchBlock endpoint via the method=1 query parameter. The description describes the flaw as requiring authentication, while the assigned CVSS vectors (3.1:...
CVE-2026-87807 siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...
EUVD-2026-74833
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...
CVE-2026-87807
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...
CVE-2026-87807 siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...
PT-2026-88948
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...