Cross-notebook read and write via stacked SQL injection

SQL injection in SiYuan before 3.7.3 allows remote attackers to read and modify cleartext notebook data via a crafted search keyword. The searchDocs and NAMFilter paths splice each keyword token into SQL LIKE literals without escaping or binding, then execute the query on a read-write SQLite handle that accepts stacked statements. A publish RoleReader token is sufficient, and anonymous access works when publish authentication is disabled; encrypted notebooks are excluded and default builds do not permit code execution.