CVE-2024-41943

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validation or sanitation. An attacker can exploit this vulnerability by inserting a payload in the PDF notes that contains malicious code or script. This code will then be executed when the page is loaded in the browser. The vulnerability was fixed in version 5.11.1.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-419446.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route in CVE-2024-419453.1fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactio CVE-2024-419467.5REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX CVE-2024-419475.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another CVE-2024-419485.0biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-419496.4biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-41952.7Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authent CVE-2024-419507.5Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. H CVE-2024-419514.4Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the m CVE-2024-419525.3Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which CVE-2024-419536.1Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamic CVE-2024-419547.8FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt