Vendor
Kentico
38 known vulnerabilities.
10 results · Clear filters · Feed
-
High 7.7
Stored Cross-site Scripting (XSS) in Kentico Xperience 13
Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
-
High 7.5
Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service
A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through mal…
-
High 7.5
Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure
An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages. Detailed error messages can expose internal system information and potentially reveal implementa…
-
High 8.8
Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection
A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method …
-
High 7.5
Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability
A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms. The hotfix introduces an additional security layer to prevent hash value reuse and potential exploitation.
-
High 7.2
Kentico Xperience <= 10 Administrator Access Control Bypass
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive …
-
High 8.8
Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload
An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious f…
-
High 7.2CVE-2025-32370 Public exploit
Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated upl…
-
High 8.7
Kentico Xperience <= 13.0.180 Unsafe Reflection
An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180.
-
High 7.2CVE-2025-2749 Exploited
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed se…
KEV Apr 20, 2026