CVE-2026-116170

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content,...

CVE-2026-116170

SiYuan versions prior to v3.8.7 are vulnerable to a SQL Injection (CWE-89) vulnerability. The issue is caused by the failure to escape op and type=3 query values, allowing admin-token holders to execute crafted UNION SELECT payloads. This can occur via the searchHistory or getHistoryItems endpoin...

CVE-2026-116170 SiYuan before v3.8.7 SQL Injection via History Search op and query

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content,...

EUVD-2026-109431

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content,...

EUVD-2024-51982

Malicious code in bioql PyPI...

CVE-2024-53504

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory...

CVE-2024-53504

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory...

CVE-2024-53504

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory...

Siyuan security vulnerabilities

SiYuan is a privacy-first personal knowledge management system from SiYuan open source. A security vulnerability exists in Siyuan version 3.1.11, which stems from an SQL injection vulnerability contained in the notebook parameter of the /searchHistory file...

PT-2024-35764

Name of the Vulnerable Software and Affected Versions Siyuan version 3.1.11 Description A SQL injection issue has been identified in the notebook parameter through the "/searchHistory" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of...

CVE-2024-53504

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory...

CVE-2024-53504: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory...

CVE-2024-53504

A SQL injection vulnerability exists in Siyuan version 3.1.11 . The flaw is triggered through the notebook parameter in the /searchHistory file. This vulnerability allows for the improper neutralization of special elements used in an SQL command. Exploitation details or specific remediation steps...

CVE-2024-53504

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory...

CVE-2024-53504

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory...

PT-2019-10102

Name of the Vulnerable Software and Affected Versions: Xiaomi Stock Browser version 10.2.4.g Description: The issue allows a third-party application to read the user's cleartext browser history. This can be achieved via an app.provider.query request to the...