rootpwn

critical · CVSS v3 8.8 · CVSS v4 8.6

CVE-2026-93923

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing st…

Description

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

Scores

Severity
critical
CVSS v2
10
CVSS v3
8.8
CVSS v4
8.6
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-93922

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

View analysis

critical

CVE-2026-93031

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.

View analysis

critical

CVE-2026-93839

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.

View analysis

critical

CVE-2026-93868

Cotonti CMS up to version 1.0.0 generates predictable password‑recovery tokens using md5(microtime()), allowing attackers to brute‑force reset any account password, including administrators. The flaw is exploitable without authentication and can be performed within a narrow time window. It is critical due to the ease of token prediction and lack of rate limiting.

View analysis