{"id":"CVE-2021-47711","aliases":["EUVD-2025-204369","GHSA-hhh6-7j8c-5mhg"],"status":"published","title":"Kentico Xperience \u003c= 13.0.52 Online Marketing Macros SQL Injection","description":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00301,"percentile":0.23037,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2025-12-18T19:53:26Z","modified":"2026-06-17T04:18:20Z","products":[{"vendor":"kentico","product":"xperience"}],"references":[{"url":"https://devnet.kentico.com/download/hotfixes","tags":["vendor-advisory","patch","Product"]},{"url":"https://www.vulncheck.com/advisories/kentico-xperience-online-marketing-macros-sql-injection","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47711"},{"url":"https://github.com/advisories/GHSA-hhh6-7j8c-5mhg"}],"sources":{"cve":[{"id":"CVE-2021-47711","title":"Kentico Xperience \u003c= 13.0.52 Online Marketing Macros SQL Injection","description":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.","status":"published","published":"2025-12-18T19:53:26.564Z","modified":"2025-12-18T21:48:09.105Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:56.308189Z"}],"euvd":[{"id":"EUVD-2025-204369","description":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.","status":"published","published":"2025-12-18T19:53:26Z","modified":"2025-12-18T21:48:09Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:02.571203Z"}],"ghsa":[{"id":"GHSA-hhh6-7j8c-5mhg","title":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject...","description":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.","status":"published","published":"2025-12-18T21:31:42Z","modified":"2025-12-18T21:31:50Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:05:16.915197Z"}],"nvd":[{"id":"CVE-2021-47711","description":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.","status":"published","published":"2025-12-18T20:15:49.653Z","modified":"2026-06-17T04:18:20.393Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:09.005706Z"}]}}