Medium · 6.1 CVE-2021-41563 EUVD-2021-28579GHSA-6p96-35cj-r28v

Tad Book3 - Stored XSS

Published Oct 8, 2021 · Updated Sep 16, 2024 · Assigned by twcert

Description

Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.

Affected products

Vendor	Product	Affected	Fixed
Tad	Tad Book3	≤ 3.89	—

References

https://www.twcert.org.tw/tw/cp-132-5167-2defb-1.html