CVE-2025-5591 | Medium | 5.4 | 2026-01-05 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and per… |
CVE-2024-58323 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows mali… |
CVE-2024-58322 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead… |
CVE-2024-58321 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers… |
CVE-2024-58320 | Medium | 5.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentic… |
CVE-2024-58319 | Medium | 6.1 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration d… |
CVE-2024-58318 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and f… |
CVE-2024-58317 | Medium | 5.3 | 2025-12-18 | A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.conf… |
CVE-2023-53934 | High | 7.5 | 2025-12-18 | A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improp… |
CVE-2023-53738 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can… |
CVE-2023-53737 | Medium | 4.8 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. At… |
CVE-2023-53736 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Att… |
CVE-2022-50686 | High | 7.5 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messag… |
CVE-2022-50685 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachment… |
CVE-2022-50684 | Medium | 6.1 | 2025-12-18 | An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields. Un… |
CVE-2022-50683 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration. This allows… |
CVE-2022-50682 | Medium | 6.5 | 2025-12-18 | A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine. This… |
CVE-2022-50681 | Medium | 6.1 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich te… |
CVE-2022-50680 | Medium | 4.8 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates. Attacke… |
CVE-2021-47712 | High | 7.5 | 2025-12-18 | A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms. The hotfix in… |
CVE-2021-47711 | High | 8.8 | 2025-12-18 | A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. T… |
CVE-2020-36891 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions… |
CVE-2020-36890 | High | 7.2 | 2025-12-18 | An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Att… |
CVE-2020-36889 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted o… |
CVE-2019-25230 | Medium | 4.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget propertie… |
CVE-2019-25229 | High | 8.8 | 2025-12-18 | An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC f… |
CVE-2019-25228 | Medium | 5.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with… |
CVE-2025-32370 | High | 7.2 | 2025-04-06 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed… |
CVE-2025-32369 | Medium | 6.4 | 2025-04-06 | Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library f… |
CVE-2025-2794 | | | 2025-03-31 | An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service conditio… |
CVE-2025-2878 | Low | 2.4 | 2025-03-27 | A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-2749 | High | 7.2 | 2025-03-24 | An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations… |
CVE-2025-2748 | Medium | 6.1 | 2025-03-24 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This… |
CVE-2025-2747 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server… |
CVE-2025-2746 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames… |
CVE-2024-12907 | | | 2025-01-02 | Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.a… |
CVE-2022-32387 | High | 7.5 | 2022-07-18 | In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler. |
CVE-2022-29287 | Medium | 4.9 | 2022-04-16 | Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator)… |
CVE-2021-46163 | Medium | 6.1 | 2022-01-10 | Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem. |
CVE-2021-43991 | Medium | 6.8 | 2021-12-03 | The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order X… |
CVE-2021-27581 | Critical | 9.8 | 2021-03-05 | The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter. |
CVE-2020-24794 | Medium | 6.1 | 2020-09-09 | Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75. |
CVE-2019-19493 | Medium | 5.4 | 2019-12-02 | Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS. |
CVE-2019-12102 | Critical | 9.1 | 2019-05-22 | Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageorme… |
CVE-2018-19453 | High | 8.8 | 2019-04-10 | Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type. |
CVE-2019-10068 | Critical | 9.8 | 2019-03-26 | An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security… |
CVE-2019-6242 | High | 7.2 | 2019-02-08 | Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this… |
CVE-2017-17736 | Critical | 9.8 | 2018-03-23 | Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then na… |
CVE-2018-6843 | High | 7.2 | 2018-03-19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface. |
CVE-2018-6842 | Medium | 5.4 | 2018-03-19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page. |
CVE-2018-7205 | Medium | 4.8 | 2018-02-20 | Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScrip… |
CVE-2018-7046 | High | 7.2 | 2018-02-20 | Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .N… |
CVE-2018-5282 | High | 7.8 | 2018-01-08 | Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. NOT… |
CVE-2015-7823 | | | 2015-10-21 | Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and… |
CVE-2015-7822 | | | 2015-10-21 | Multiple cross-site scripting (XSS) vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter name t… |