Description
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.
Published: 2024-11-29
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-51984 A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.
History

Mon, 14 Apr 2025 17:15:00 +0200

Type Values Removed Values Added
First Time appeared B3log
B3log siyuan
CPEs cpe:2.3:a:b3log:siyuan:3.1.11:-:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan

Mon, 02 Dec 2024 18:15:00 +0100

Type Values Removed Values Added
First Time appeared Siyuan
Siyuan siyuan
Weaknesses CWE-89
CPEs cpe:2.3:a:siyuan:siyuan:*:*:*:*:*:*:*:*
Vendors & Products Siyuan
Siyuan siyuan
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 29 Nov 2024 20:30:00 +0100

Type Values Removed Values Added
Description A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.
References

Subscriptions

B3log Siyuan
Siyuan Siyuan
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-12-02T16:47:00.312Z

Reserved: 2024-11-20T00:00:00.000Z

Link: CVE-2024-53506

cve-icon Vulnrichment

Updated: 2024-12-02T16:46:50.442Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-29T20:15:20.943

Modified: 2026-06-17T08:08:57.160

Link: CVE-2024-53506

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')