Kacper Paluch

**Name of the Vulnerable Software and Affected Versions** Magnolia CMS versions prior to 6.3.10 **Description** Stored Cross-Site Scripting (XSS) exists in the import functionality. An attacker with editor privileges can inject arbitrary HTML and JavaScript into the name of an uploaded image, which is then rendered and executed when the image is opened. **Recommendations** Update to version 6.3.10.

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 8.4.3 through Infinity 24.2.1 Description: The issue is related to an XSS problem with Mashup, which is caused by improper neutralization of input during web page generation, also known as cross-site scripting. This is classified as CWE-79. Recommendations: For Pega Platform versions 8.4.3 through Infinity 24.2.1, consider disabling the Mashup feature until a patch is available to prevent potential exploitation of the XSS issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 7.2.1 through Infinity 24.2.1 Description: The issue is related to an XSS problem with Mashup in Pega Platform. Recommendations: For Pega Platform versions 7.2.1 through Infinity 24.2.1, consider disabling the Mashup feature until a patch is available to mitigate the risk of exploitation.