cve/2024/CVE-2024-25676.md

### [CVE-2024-25676](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25676)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads to both open redirection and out-of-band resource loading.

### POC

#### Reference
- https://cds.thalesgroup.com/en/tcs-cert/CVE-2024-25676
- https://excellium-services.com/cert-xlm-advisory/cve-2024-25676

#### Github
No PoCs found on GitHub currently.