Kentico vulnerabilities

Products

• Xperience 51
• Cms 3
• Xperience 2
• Xperience Cms 2

Newest

• kentico xperience Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration... CVE-2026-105046 4.3 MediumOctober 2, 2026
• kentico xperience Stored Cross-site Scripting (XSS) in Kentico Xperience 13 CVE-2025-5591 7.7 HighJanuary 5, 2026
• kentico xperience Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS CVE-2024-58323 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.158 Shipping Options Stored XSS CVE-2024-58322 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.159 Form Validation Stored XSS CVE-2024-58321 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.159 Authentication Information Disclosure CVE-2024-58320 6.9 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS CVE-2024-58319 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS CVE-2024-58318 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.164 Cookie Security Configuration CVE-2024-58317 6.9 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service CVE-2023-53934 8.7 HighDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.109 Page Preview Reflected XSS CVE-2023-53738 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.101 Localization Application Stored XSS CVE-2023-53737 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS CVE-2023-53736 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure CVE-2022-50686 6.9 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.56 File Upload Stored XSS CVE-2022-50685 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.71 Form Emails HTML Injection CVE-2022-50684 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.74 Form Configuration Stored XSS CVE-2022-50683 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection CVE-2022-50682 6.9 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS CVE-2022-50681 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.92 Email Marketing Stored XSS CVE-2022-50680 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability CVE-2021-47712 6.9 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection CVE-2021-47711 8.7 HighDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0.49 File Upload Stored XSS CVE-2020-36891 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 10 Administrator Access Control Bypass CVE-2020-36890 8.6 HighDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0.90 Administration Interface Stored XSS CVE-2020-36889 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0.0 User Widget Information Disclosure CVE-2019-25230 5.3 MediumDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload CVE-2019-25229 8.7 HighDecember 18, 2025
• kentico xperience Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure CVE-2019-25228 5.1 MediumDecember 18, 2025
• kentico xperience Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions... CVE-2025-32370 Public exploit 7.2 HighApril 6, 2025
• kentico xperience Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for... CVE-2025-32369 6.4 MediumApril 6, 2025
• kentico xperience Kentico Xperience <= 13.0.180 Unsafe Reflection CVE-2025-2794 8.7 HighMarch 31, 2025
• kentico cms Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting CVE-2025-2878 4.8 MediumMarch 27, 2025
• kentico xperience Kentico Xperience stored cross-site scripting in multiple-file upload functionality CVE-2025-2748 Public exploit EPSS 60.6% 6.1 MediumMarch 24, 2025
• kentico xperience Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE CVE-2025-2749 In KEV 7.2 HighMarch 24, 2025
• kentico xperience, xperience cms +1 more Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass CVE-2025-2747 In KEV EPSS 97.2% 9.8 CriticalMarch 24, 2025
• kentico xperience, xperience cms +1 more Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass CVE-2025-2746 In KEV EPSS 74.1% 9.8 CriticalMarch 24, 2025
• kentico cms XSS in Kentico 7 CVE-2024-12907 5.3 MediumJanuary 2, 2025
• kentico xperience In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the... CVE-2022-32387 7.5 HighJuly 18, 2022
• kentico xperience Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an... CVE-2022-29287 4.9 MediumApril 15, 2022
• kentico xperience Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem. CVE-2021-46163 6.1 MediumJanuary 9, 2022
• kentico xperience, xperience xms +1 more Persistent XSS via Avatar Upload in Kentico Xperience CMS CVE-2021-43991 6.8 MediumDecember 3, 2021
• kentico cms The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter. CVE-2021-27581 9.8 CriticalMarch 5, 2021
• kentico xperience Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75. CVE-2020-24794 6.1 MediumSeptember 9, 2020
• kentico xperience Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with... CVE-2019-19493 Public exploit 5.4 MediumDecember 2, 2019
• kentico xperience Kentico 11 through 12 lets attackers upload and explore files without authentication via the... CVE-2019-12102 Public exploitDisputed 9.1 CriticalMay 22, 2019
• kentico xperience Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type. CVE-2018-19453 8.8 HighApril 10, 2019
• kentico xperience An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10... CVE-2019-10068 In KEVPublic exploit EPSS 95.1% 9.8 CriticalMarch 26, 2019
• kentico xperience ** DISPUTED ** Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password... CVE-2019-6242 Disputed 7.2 HighFebruary 8, 2019
• kentico xperience Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global... CVE-2017-17736 Public exploit EPSS 68.5% 9.8 CriticalMarch 23, 2018
• kentico xperience Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface. CVE-2018-6843 7.2 HighMarch 19, 2018
• Show olderLoading…