Threats tagged 'ghsa-7h72-q9rr-77j7'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.1	CVE-2026-120428PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated Medium5.12026-11-02GCVE DatabaseCVE-2026-120428 PandaWiki versions 3.65.0 through 3.87.5 have a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can upload HTML files disguised with image extensions via the /share/v1/common/file/upload endpoint. By tricking administrators into visiting a crafted URL, attackers can bypass nginx's attachment header to serve the HTML inline, enabling theft of the panda_wiki_token JWT and potential session takeover. Report on CVE-2026-120428 Vulnerability CWE-79 #ghsa-7h72-q9rr-77j7	GCVE Database	2026-11-02

Page 1 of 1