The vulnerability CVE-2024-47372 affects ThemeNcode LLC's TNC PDF viewer versions up to 3.1.0 and is classified as CWE-79, indicating improper neutralization of input during web page generation leading to stored cross-site scripting (XSS). This allows an attacker with high privileges and user interaction to inject malicious scripts that persist within the application, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 5.9, reflecting a medium severity level. No patch or official remediation has been disclosed by the vendor, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this stored XSS vulnerability could allow an attacker with high privileges to execute malicious scripts in the context of the TNC PDF viewer, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates that user interaction is required and the attacker must have privileges, which limits the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor for vendor updates and avoid exposing the vulnerable versions to untrusted users. Implementing web application firewalls or input filtering may provide some protection but are not guaranteed to fully mitigate the issue.