İçeriğe atla
Noroxi

b3log kayıtları

b3log üreticisine ait 70 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
7
Düzeltme kaydı olan
%65,7
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

70 kayıt
  • CVE-2018-10469
    40Planlayın

    b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI

    KritikCVSS 9,8İstismar yokEPSS %2

    b3log · symphony27 Nis 2018

  • CVE-2024-23049
    39İzleyin

    An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

    KritikCVSS 9,8İstismar yokEPSS %1

    b3log · symphony5 Şub 2024

  • CVE-2026-30869
    39İzleyin

    SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

    KritikCVSS 9,8İstismar yokEPSS %1

    b3log · siyuan10 Mar 2026

  • CVE-2026-32767
    39İzleyin

    SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

    KritikCVSS 9,8İstismar yokEPSS %1

    b3log · siyuan19 Mar 2026

  • CVE-2024-53507
    39İzleyin

    A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.

    KritikCVSS 9,8İstismar yokEPSS %1

    b3log · siyuan29 Kas 2024

  • CVE-2024-53504
    39İzleyin

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.

    KritikCVSS 9,8İstismar yokEPSS %1

    b3log · siyuan29 Kas 2024

  • CVE-2024-53506
    39İzleyin

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.

    KritikCVSS 9,8İstismar yokEPSS %1

    b3log · siyuan29 Kas 2024

  • CVE-2024-53505
    39İzleyin

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.

    KritikCVSS 9,8İstismar yokEPSS %1

    b3log · siyuan29 Kas 2024

  • CVE-2026-34449
    38İzleyin

    SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

    KritikCVSS 9,6İstismar yokEPSS %1

    b3log · siyuan31 Mar 2026

  • CVE-2024-2692
    36İzleyin

    SiYuan 3.0.3 - RCE via Server Side XSS

    KritikCVSS 9,0İstismar yokEPSS %1

    b3log · siyuan3 Nis 2024

  • CVE-2026-34448
    36İzleyin

    SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client

    KritikCVSS 9,0İstismar yokEPSS %1

    b3log · siyuan31 Mar 2026

  • CVE-2026-39846
    36İzleyin

    SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

    KritikCVSS 9,0İstismar yokEPSS %1

    b3log · siyuan7 Nis 2026

  • CVE-2026-32749
    36İzleyin

    SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

    KritikCVSS 9,1İstismar yokEPSS %1

    b3log · siyuan19 Mar 2026

  • CVE-2026-40322
    36İzleyin

    SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

    KritikCVSS 9,0İstismar yokEPSS %1

    b3log · siyuan16 Nis 2026

  • CVE-2025-67488
    35İzleyin

    SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

    YüksekCVSS 8,8İstismar yokEPSS %0

    b3log · siyuan9 Ara 2025

  • CVE-2024-55657
    34İzleyin

    SiYuan has an arbitrary file read via /api/template/render

    YüksekCVSS 8,7İstismar yokEPSS %1

    b3log · siyuan11 Ara 2024

  • CVE-2024-55658
    34İzleyin

    SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

    YüksekCVSS 8,7İstismar yokEPSS %1

    b3log · siyuan11 Ara 2024

  • CVE-2026-34605
    34İzleyin

    SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    b3log · siyuan31 Mar 2026

  • CVE-2025-21609
    34İzleyin

    SiYuan has an arbitrary file deletion vulnerability

    YüksekCVSS 8,7İstismar yokEPSS %1

    b3log · siyuan3 Oca 2025

  • CVE-2026-40107
    34İzleyin

    SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

    YüksekCVSS 8,7İstismar yokEPSS %0

    b3log · siyuan9 Nis 2026

  • CVE-2026-40318
    34İzleyin

    SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

    YüksekCVSS 8,5İstismar yokEPSS %0

    b3log · siyuan16 Nis 2026

  • CVE-2024-55659
    34İzleyin

    SiYuan has an arbitrary file write in the host via /api/asset/upload

    YüksekCVSS 8,7İstismar yokEPSS %0

    b3log · siyuan11 Ara 2024

  • CVE-2026-23851
    33İzleyin

    SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

    YüksekCVSS 8,3İstismar yokEPSS %1

    b3log · siyuan19 Oca 2026

  • CVE-2026-32110
    33İzleyin

    SiYuan has a Full-Read SSRF via /api/network/forwardProxy

    YüksekCVSS 8,3İstismar yokEPSS %0

    b3log · siyuan11 Mar 2026

  • CVE-2026-40259
    32İzleyin

    SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

    YüksekCVSS 8,1İstismar yokEPSS %1

    b3log · siyuan16 Nis 2026