Grimmory
Monthly
Stored XSS in Grimmory's browser-based EPUB reader (versions prior to 2.3.1) allows a low-privileged attacker who can add books to the library to embed arbitrary JavaScript in a crafted EPUB file, which executes in any opening user's browser with full access to the Grimmory session context. If an administrator opens the malicious book, the attacker can steal the admin session token and achieve full account takeover. No public exploit has been identified (EPSS 0.01%, 1st percentile), and vendor-released patch v2.3.1 is available.
Stored XSS in Grimmory's browser-based EPUB reader (versions prior to 2.3.1) allows a low-privileged attacker who can add books to the library to embed arbitrary JavaScript in a crafted EPUB file, which executes in any opening user's browser with full access to the Grimmory session context. If an administrator opens the malicious book, the attacker can steal the admin session token and achieve full account takeover. No public exploit has been identified (EPSS 0.01%, 1st percentile), and vendor-released patch v2.3.1 is available.