CVE-2026-120428

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/?a=.pdf, bypassing the nginx attachment header ...

CVE-2026-120428

PandaWiki versions 3.65.0 through 3.87.5 are vulnerable to a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can upload HTML files using image extensions via the /share/v1/common/file/upload endpoint. By luring administrators to a crafted URL such as /static-file/?a=.pd...

CVE-2026-120428 PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/?a=.pdf, bypassing the nginx attachment header ...

EUVD-2026-115237

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/?a=.pdf, bypassing the nginx attachment header ...