EUVD-2026-125620

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that...

CVE-2026-129140

Versions 1.0.0 through 1.0.3 of paicoding are vulnerable to a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The root cause is located in the ImageServiceImpl.validateStaticImg method, which fails to restrict SVG files . When these files are uploaded and served...

CVE-2026-129141

Versions 1.0.0 through 1.0.3 of paicoding are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the SeoInjectService component embeds user profile text into an inline JSON-LD script element without proper escaping. This allows an authenticated attacker to inject a clo...

EUVD-2026-125619

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for...