Skip to contentKentico Xperience vulnerabilities
- kentico xperienceKentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration...CVE-2026-1050464.3 Medium
- kentico xperienceStored Cross-site Scripting (XSS) in Kentico Xperience 13CVE-2025-55917.7 High
- kentico xperienceKentico Xperience <= 13.0.158 Checkbox Form Component Stored XSSCVE-2024-583235.1 Medium
- kentico xperienceKentico Xperience <= 13.0.158 Shipping Options Stored XSSCVE-2024-583225.1 Medium
- kentico xperienceKentico Xperience <= 13.0.159 Form Validation Stored XSSCVE-2024-583215.1 Medium
- kentico xperienceKentico Xperience <= 13.0.159 Authentication Information DisclosureCVE-2024-583206.9 Medium
- kentico xperienceKentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSSCVE-2024-583195.1 Medium
- kentico xperienceKentico Xperience <= 13.0.162 Rich Text Editor Stored XSSCVE-2024-583185.1 Medium
- kentico xperienceKentico Xperience <= 13.0.164 Cookie Security ConfigurationCVE-2024-583176.9 Medium
- kentico xperienceKentico Xperience <= 12.0.98 GetResource Handler Denial of ServiceCVE-2023-539348.7 High
- kentico xperienceKentico Xperience <= 13.0.109 Page Preview Reflected XSSCVE-2023-537385.1 Medium
- kentico xperienceKentico Xperience <= 13.0.101 Localization Application Stored XSSCVE-2023-537375.1 Medium
- kentico xperienceKentico Xperience <= 13.0.120 Administration Interface Reflected XSSCVE-2023-537365.1 Medium
- kentico xperienceKentico Xperience <= 12.0 Portal Engine Form Control Information DisclosureCVE-2022-506866.9 Medium
- kentico xperienceKentico Xperience <= 13.0.56 File Upload Stored XSSCVE-2022-506855.1 Medium
- kentico xperienceKentico Xperience <= 13.0.71 Form Emails HTML InjectionCVE-2022-506845.1 Medium
- kentico xperienceKentico Xperience <= 13.0.74 Form Configuration Stored XSSCVE-2022-506835.1 Medium
- kentico xperienceKentico Xperience <= 13.0.79 Routing Engine CRLF InjectionCVE-2022-506826.9 Medium
- kentico xperienceKentico Xperience <= 13.0.88 Rich Text Editor Reflected XSSCVE-2022-506815.1 Medium
- kentico xperienceKentico Xperience <= 13.0.92 Email Marketing Stored XSSCVE-2022-506805.1 Medium
- kentico xperienceKentico Xperience <= 12.0.102 URL Hashing Cryptography VulnerabilityCVE-2021-477126.9 Medium
- kentico xperienceKentico Xperience <= 13.0.52 Online Marketing Macros SQL InjectionCVE-2021-477118.7 High
- kentico xperienceKentico Xperience <= 12.0.49 File Upload Stored XSSCVE-2020-368915.1 Medium
- kentico xperienceKentico Xperience <= 10 Administrator Access Control BypassCVE-2020-368908.6 High
- kentico xperienceKentico Xperience <= 12.0.90 Administration Interface Stored XSSCVE-2020-368895.1 Medium
- kentico xperienceKentico Xperience <= 12.0.0 User Widget Information DisclosureCVE-2019-252305.3 Medium
- kentico xperienceKentico Xperience <= 12.0.29 MVC Forms Unrestricted File UploadCVE-2019-252298.7 High
- kentico xperienceKentico Xperience <= 12.0.47 Virtual Context Information DisclosureCVE-2019-252285.1 Medium
- kentico xperienceKentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions...CVE-2025-32370Public exploit7.2 High
- kentico xperienceKentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for...CVE-2025-323696.4 Medium
- kentico xperienceKentico Xperience <= 13.0.180 Unsafe ReflectionCVE-2025-27948.7 High
- kentico xperienceKentico Xperience stored cross-site scripting in multiple-file upload functionalityCVE-2025-2748Public exploitEPSS 60.6%6.1 Medium
- kentico xperienceKentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCECVE-2025-2749In KEV7.2 High
- kentico xperience, xperience cms +1 moreKentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication BypassCVE-2025-2747In KEVEPSS 97.2%9.8 Critical
- kentico xperience, xperience cms +1 moreKentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication BypassCVE-2025-2746In KEVEPSS 74.1%9.8 Critical
- kentico xperienceIn Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the...CVE-2022-323877.5 High
- kentico xperienceKentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an...CVE-2022-292874.9 Medium
- kentico xperienceKentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem.CVE-2021-461636.1 Medium
- kentico xperience, xperience xms +1 morePersistent XSS via Avatar Upload in Kentico Xperience CMSCVE-2021-439916.8 Medium
- kentico xperienceCross Site Scripting (XSS) vulnerability in Kentico before 12.0.75.CVE-2020-247946.1 Medium
- kentico xperienceKentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with...CVE-2019-19493Public exploit5.4 Medium
- kentico xperienceKentico 11 through 12 lets attackers upload and explore files without authentication via the...CVE-2019-12102Public exploitDisputed9.1 Critical
- kentico xperienceKentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.CVE-2018-194538.8 High
- kentico xperienceAn issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10...CVE-2019-10068In KEVPublic exploitEPSS 95.1%9.8 Critical
- kentico xperience** DISPUTED ** Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password...CVE-2019-6242Disputed7.2 High
- kentico xperienceKentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global...CVE-2017-17736Public exploitEPSS 68.5%9.8 Critical
- kentico xperienceKentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.CVE-2018-68437.2 High
- kentico xperienceKentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper...CVE-2018-68425.4 Medium
- kentico xperience** DISPUTED ** Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout"...CVE-2018-7205Disputed4.8 Medium
- kentico xperience** DISPUTED ** Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote...CVE-2018-7046Disputed7.2 High
- Show olderLoading…