CVE-2026-129142

paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious displa...

CVE-2026-129142

The paicoding platform (commits 766c48b through 903adce) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the payment notifications system. The root cause is that NotifyMsgListener inserts a payer's display name without proper escaping, which is subsequently rendered in notify-sys...

CVE-2026-129142 paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications

paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious displa...