Description
Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.
This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Proget | Proget | < 2.17.5 | 2.17.5 |
References
- https://cert.pl/en/posts/2025/05/CVE-2025-1415 third-party-advisory
- https://proget.pl/en/mobile-device-management/ product