CVE-2024-23505 is a CWE-79 stored cross-site scripting vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF, affecting versions through 2.0.38. It results from improper input neutralization during web page generation, enabling stored XSS attacks. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), indicating an attacker with low privileges and requiring user interaction can cause partial compromise of confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial disclosure of information, modification of data, and disruption of service. The CVSS vector indicates that the attacker requires low privileges and user interaction, and the vulnerability affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewalls or input sanitization as temporary mitigations. Monitor vendor communications for updates on patches or official fixes.