Description
The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HCLSoftware | BigFix MCM & Mobile | <= 3.7 | — |
Advisories 1
- WID-SEC-2026-4366 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026