CVE-2020-36891
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-T
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers.
MEDIUM · CVSS 5.4
EPSS 0.00024
Monitor
- No active-exploitation, high-EPSS, or public-exploit signals - routine patching cadence
Sigma rules0
YARA rules0