Threats affecting pkg:github/paicoding

CVE-2026-129139 is a vulnerability in the itwanger paicoding product where accounts created via ZSXQ login use predictable credentials. The username and password are both derived solely from the member's ZSXQ number, which can be read by unauthenticated attackers from the victim's profile page. This allows attackers to compute the credentials and log in to the victim's account without authentication.

paicoding versions 1.0.0 through 1.0.3 have a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The vulnerability arises because the ImageServiceImpl.validateStaticImg method accepts SVG files that can contain embedded scripts. When these SVG images are stored locally and served from the site origin, authenticated attackers can upload malicious SVGs that execute scripts in the context of other users viewing them. This can lead to theft of non-HttpOnly session cookies and account hijacking.

paicoding versions 1.0.0 through 1.0.3 contain a stored cross-site scripting (XSS) vulnerability. The SeoInjectService component embeds user profile text into an inline JSON-LD script element without proper escaping. Authenticated attackers can inject a closing script tag and arbitrary HTML into their profile, enabling script execution in the context of visitors viewing that profile page. This can lead to theft of non-HttpOnly f-session cookies.

CVE-2026-129142 is a stored cross-site scripting (XSS) vulnerability in the paicoding product by itwanger. The flaw occurs in the payment notifications feature, where the payer's display name is inserted without proper escaping and rendered unsafely in the notification HTML. Authenticated attackers can exploit this by setting a malicious display name and initiating a pending payment on a paid article, causing script execution in the author's browser when viewing notifications.

paicoding version 1.0.3 has a missing authorization vulnerability in its ArticleRestController article detail endpoint. This flaw allows unauthenticated attackers to access restricted articles, including paid, login-only, member-only, and draft content, by enumerating article IDs via a GET request.

paicoding version 1.0.3 has a payment bypass vulnerability that allows authenticated attackers to unlock paid articles without completing payment. The flaw arises from a small space of random payment confirmation codes, enabling attackers to guess valid codes by enumerating approximately 2000 counter values and submitting matching verification codes to an unauthenticated callback endpoint to mark payments as completed.