CVE-2026-120428

Published 2 November 2026 · tracked since 2 November 2026

Description

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment heade

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-120318 HIGH 7.2
• CVE-2026-109083
• CVE-2026-110535
• CVE-2026-111959
• CVE-2026-113511
• CVE-2026-113687
• CVE-2026-114364
• CVE-2026-102802
• CVE-2026-103419
• CVE-2026-103420

→ Open the live CVE board · all tools