CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 2.8.0.
Explanation of Vulnerability in Simple Terms
TNC PDF Viewer versions up to 2.8.0 contain a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts. The vulnerability requires user interaction and can affect other users viewing the same content. An attacker with low-level access can craft a malicious PDF or input that executes JavaScript in victims' browsers, potentially stealing session data or performing actions on their behalf.
What an attacker can do
Inject JavaScript that runs in other users' browsers when they view a PDF or interact with the plugin.
Potential impact on your site
Users' sessions or data could be compromised if they view PDFs created by attackers with site access.
Conditions required to exploit
Attacker must have a low-level user account and the victim must view the malicious content.
Key dates
External resources
Related vulnerabilities
