7 matches found
CVE-2026-124687
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...
CVE-2026-124687 Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...
CVE-2026-124687
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the "id" and "target" attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...
EUVD-2026-123580
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...
CVE-2026-124687
Progress Kendo UI for jQuery (versions 2022.2.621 prior to 2026.4.1111 ) is vulnerable to Cross-Site Scripting (XSS) . The DropDownButton and SplitButton components fail to properly neutralize the id and target attributes, allowing an attacker who can influence these values to break out of the at...
CVE-2026-124687: Progress Software Kendo UI for jQuery: In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton…
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...
PT-2026-145264
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event...