EUVD Vulnerability Catalog
EUVD-2026-110926
Severity: MEDIUM
Base Score: 5.1
CVSS Version: 4.0
Vulnerability Description
KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session.
This issue has been fixed in version 1.2.8.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): Low
▪
User Interaction (UI): Passive
▪
Vulnerability Confidentiality Impact (VC): None
▪
Vulnerability Integrity Impact (VI): None
▪
Vulnerability Availability Impact (VA): None
▪
Subsequent Confidentiality Impact (SC): Low
▪
Subsequent Integrity Impact (SI): Low
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
KGS Software
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
CERT-PL
EPSS Probability
0
Known Aliases
CVE-2026-105987
GHSA-52vr-mm4v-p8xx
Published On
2026-10-27
Last Updated
2026-10-27