B3log Vulnerabilities

This vulnerability allows low-privilege users to modify existing notebook content in the SiYuan knowledge management system, even though they should only have read-only access. It occurs because the system doesn't properly check user permissions, enabling these users to add new content to documents through a specific API.

This vulnerability allows an attacker to inject malicious JavaScript into the SiYuan web application, which can then execute actions on behalf of a logged-in user if they click on a crafted link. It can be exploited without any authentication, making it particularly dangerous for users who might unknowingly open the link.

This vulnerability allows any logged-in user, including those with just read access, to execute any SQL query on the database, potentially exposing or altering sensitive data. It affects versions prior to 3.6.0 and is fixed in that version, so users should update to secure their systems.