GHSA-2723-m3jj-w933MediumCVSS 5.4
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting...
🔗 CVE IDs covered (1)
📋 Description
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129142
- https://github.com/itwanger/paicoding/issues/137
- https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/notify/service/impl/NotifyMsgListener.java#L274-L288
- https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/components/notice/notify-system-item.html#L18
- https://vul.yulun.ac.cn/20261112/paicoding
- https://www.vulncheck.com/advisories/paicoding-commit-766c48b-through-903adce-stored-xss-via-payment-notifications
- https://github.com/advisories/GHSA-2723-m3jj-w933