Skip to content
Noroxi

b3log records

70 published records for vendor b3log.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
7
With a fix record
65.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

70 records
  • CVE-2018-10469
    40Plan

    b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI

    CriticalCVSS 9.8No exploitEPSS 2%

    b3log · symphonyApr 27, 2018

  • CVE-2024-23049
    39Monitor

    An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

    CriticalCVSS 9.8No exploitEPSS 1%

    b3log · symphonyFeb 5, 2024

  • CVE-2026-30869
    39Monitor

    SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

    CriticalCVSS 9.8No exploitEPSS 1%

    b3log · siyuanMar 10, 2026

  • CVE-2026-32767
    39Monitor

    SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

    CriticalCVSS 9.8No exploitEPSS 1%

    b3log · siyuanMar 19, 2026

  • CVE-2024-53507
    39Monitor

    A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.

    CriticalCVSS 9.8No exploitEPSS 1%

    b3log · siyuanNov 29, 2024

  • CVE-2024-53504
    39Monitor

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.

    CriticalCVSS 9.8No exploitEPSS 1%

    b3log · siyuanNov 29, 2024

  • CVE-2024-53506
    39Monitor

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.

    CriticalCVSS 9.8No exploitEPSS 1%

    b3log · siyuanNov 29, 2024

  • CVE-2024-53505
    39Monitor

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.

    CriticalCVSS 9.8No exploitEPSS 1%

    b3log · siyuanNov 29, 2024

  • CVE-2026-34449
    38Monitor

    SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

    CriticalCVSS 9.6No exploitEPSS 1%

    b3log · siyuanMar 31, 2026

  • CVE-2024-2692
    36Monitor

    SiYuan 3.0.3 - RCE via Server Side XSS

    CriticalCVSS 9.0No exploitEPSS 1%

    b3log · siyuanApr 3, 2024

  • CVE-2026-34448
    36Monitor

    SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client

    CriticalCVSS 9.0No exploitEPSS 1%

    b3log · siyuanMar 31, 2026

  • CVE-2026-39846
    36Monitor

    SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

    CriticalCVSS 9.0No exploitEPSS 1%

    b3log · siyuanApr 7, 2026

  • CVE-2026-32749
    36Monitor

    SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

    CriticalCVSS 9.1No exploitEPSS 1%

    b3log · siyuanMar 19, 2026

  • CVE-2026-40322
    36Monitor

    SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

    CriticalCVSS 9.0No exploitEPSS 1%

    b3log · siyuanApr 16, 2026

  • CVE-2025-67488
    35Monitor

    SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

    HighCVSS 8.8No exploitEPSS 0%

    b3log · siyuanDec 9, 2025

  • CVE-2024-55657
    34Monitor

    SiYuan has an arbitrary file read via /api/template/render

    HighCVSS 8.7No exploitEPSS 1%

    b3log · siyuanDec 11, 2024

  • CVE-2024-55658
    34Monitor

    SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

    HighCVSS 8.7No exploitEPSS 1%

    b3log · siyuanDec 11, 2024

  • CVE-2026-34605
    34Monitor

    SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

    HighCVSS 8.6Proof of conceptEPSS 1%

    b3log · siyuanMar 31, 2026

  • CVE-2025-21609
    34Monitor

    SiYuan has an arbitrary file deletion vulnerability

    HighCVSS 8.7No exploitEPSS 1%

    b3log · siyuanJan 3, 2025

  • CVE-2026-40107
    34Monitor

    SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

    HighCVSS 8.7No exploitEPSS 0%

    b3log · siyuanApr 9, 2026

  • CVE-2026-40318
    34Monitor

    SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

    HighCVSS 8.5No exploitEPSS 0%

    b3log · siyuanApr 16, 2026

  • CVE-2024-55659
    34Monitor

    SiYuan has an arbitrary file write in the host via /api/asset/upload

    HighCVSS 8.7No exploitEPSS 0%

    b3log · siyuanDec 11, 2024

  • CVE-2026-23851
    33Monitor

    SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

    HighCVSS 8.3No exploitEPSS 1%

    b3log · siyuanJan 19, 2026

  • CVE-2026-32110
    33Monitor

    SiYuan has a Full-Read SSRF via /api/network/forwardProxy

    HighCVSS 8.3No exploitEPSS 0%

    b3log · siyuanMar 11, 2026

  • CVE-2026-40259
    32Monitor

    SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

    HighCVSS 8.1No exploitEPSS 1%

    b3log · siyuanApr 16, 2026