SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

Summary The /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router router.go, "不需要鉴权" -- no auth needed. When called with type=8 and a valid block id parameter, this endpoint invokes RenderDynamicIconContentTemplate, which executes a Go template tha...

CVE-2025-40887

A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data...

CVE-2025-40888

A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data...

EUVD-2014-0817

Malware in sbrugna...

PT-2025-40990

Name of the Vulnerable Software and Affected Versions Alert functionality affected versions not specified Description A SQL Injection issue exists due to inadequate input validation of a parameter within the Alert functionality. An authenticated user with limited privileges can execute arbitrary...

PT-2025-40988

Name of the Vulnerable Software and Affected Versions Smart Polling affected versions not specified Description A SQL Injection issue exists in the Smart Polling functionality because of inadequate input validation. An authenticated user with limited privileges can execute arbitrary SELECT SQL...

PT-2025-40991

Name of the Vulnerable Software and Affected Versions versions prior to 2025-40888 Description A SQL Injection issue exists in the CLI functionality because of inadequate input validation. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the database...

EUVD-2021-33339

Malicious code in bioql PyPI...

BIT-MARIADB-MIN-2021-46663

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

SUSE CVE-2021-46663

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

EulerOS Virtualization 3.0.2.6 : mariadb (EulerOS-SA-2023-1071)

According to the versions of the mariadb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - MariaDB through 10.5.9 allows an application crash in findfieldintables and findorderinlist via an unused common table expressio...

mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements

MariaDB through 10.5.13 allows a hamaria::extra application crash via certain SELECT statements...

EulerOS 2.0 SP3 : mariadb (EulerOS-SA-2022-1746)

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - MariaDB through 10.5.9 allows an application crash in findfieldintables and findorderinlist via an unused common table expression CTE...

EulerOS 2.0 SP5 : mariadb (EulerOS-SA-2022-1543)

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - MariaDB through 10.5.9 allows an application crash in findfieldintables and findorderinlist via an unused common table expression CTE...

OESA-2022-1587 mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...