medium5.4Public exploit code
CVE-2019-19493
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Kentico CMS 9.0-12.0.49 - Persistent Cross Site Scripting2020-10-09 · webapps · php
Impact
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kentico | Xperience | from 9.0 before 12.0.50 |