15 results · Clear filters · Feed
-
Medium 5.4
In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new…
-
Medium 5.4
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can cont…
-
Medium 5.4
Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause…
-
Medium 5.4
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding t…
-
Medium 5.4
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject …
-
Medium 5.4
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject addition…
-
Medium 5.4
Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containi…
-
Medium 5.4
Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a…
-
Medium 5.4
Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affec…
-
Medium 4.7
Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an othe…
-
Medium 4.7
Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inj…
-
Medium 4.7
Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can i…
-
Medium 4.7
Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker wh…
-
Medium 6.5
Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containi…
-
Medium 5.4
Cross-Site Scripting (XSS) in PdfViewer
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.