| Package | Affected versions | Patched versions |
|---|---|---|
| xperience | ≥ 9.0, ≤ 11.0 |
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free