Kentico prior to 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
kentico kentico