Product by Itwanger
Paicoding
11 known vulnerabilities in Paicoding (Itwanger), 0 of them actively exploited (CISA KEV).
Key figures
11
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-129143 | paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint | 7.5 | |
| High | CVE-2026-129139 | paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials | 8.2 | |
| Medium | CVE-2026-129142 | paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications | 5.4 | |
| Medium | CVE-2026-129144 | paicoding 1.0.3 Payment Bypass via Guessable Codes in /article/api/pay/callback | 5.4 | |
| Medium | CVE-2026-129140 | paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Upload | 5.4 | |
| Medium | CVE-2026-129141 | paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description | 5.4 | |
| Medium | CVE-2026-3286 | itwanger paicoding Image Save Endpoint ImageRestController.java save server-side request forgery | 6.3 | |
| Medium | CVE-2025-3966 | itwanger paicoding Browsing History home information disclosure | 4.3 | |
| Medium | CVE-2025-3967 | itwanger paicoding Article post improper authorization | 5.4 | |
| Medium | CVE-2025-3965 | itwanger paicoding post cross site scripting | 3.5 | |
| High | CVE-2025-4839 | itwanger paicoding CrossUtil.java cross-domain policy | 3.1 |