CVE-2026-105987

UNKNOWN 0.0

Stored XSS in KGS Software tia Viewer

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.

CWE	CWE-79
Vendor	kgs software
Product	tia viewer
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for kgs software tia viewer

Be the first to know when new unknown vulnerabilities affecting kgs software tia viewer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

KGS Software / tia Viewer

0 < 1.2.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/en/posts/2026/10/CVE-2026-105987 kgs-software.com: https://www.kgs-software.com/en/products/tia-viewer

Credits

Dawid Dudek (4c1d8urn)