EUVD-2026-125620

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that...

CVE-2026-129140

Versions 1.0.0 through 1.0.3 of paicoding are vulnerable to a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The root cause is located in the ImageServiceImpl.validateStaticImg method, which fails to restrict SVG files . When these files are uploaded and served...