Describe CVE-2017-18176.
What is CVE-2017-18176?
Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1..