KGS Software tia Viewer has a stored cross-site scripting (XSS) vulnerability in its annotation API. An authenticated attacker can inject malicious JavaScript into stickynote annotations, which executes when any user opens the affected document. This vulnerability can lead to session compromise. The issue is fixed in version 1.2.8.