CVE-2024-31090 is a reflected XSS vulnerability (CWE-79) in Hacklog Down As PDF, versions through 2.3.6. The issue arises from improper neutralization of input during web page generation, which can lead to execution of malicious scripts when a crafted input is reflected in the web response. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is remotely exploitable without privileges but requires user interaction, and can lead to partial confidentiality, integrity, and availability impacts. No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input or links related to Hacklog Down As PDF. No official mitigation or temporary fix has been published by the vendor.