title: Tad Uploader - Stored XSS
description: The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Uploader
vendor: Tad
versions:
lessThanOrEqual: 3.5.3, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
solutions: Update Tad Uploader version to 3.5.4