Browse CVEs

MEDIUM 5.4 CVE-2025-5591 Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s sessi… Xperience 13.0.167+ Fix from $1,6002026-01-05 MEDIUM 5.4 CVE-2024-58321 A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration.… Xperience after 13.0.159 Fix from $1,6002025-12-18 MEDIUM 5.4 CVE-2024-58322 A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This … Xperience after 13.0.158 Fix from $1,6002025-12-18 MEDIUM 5.4 CVE-2024-58323 A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This a… Xperience after 13.0.158 Fix from $1,6002025-12-18 MEDIUM 6.1 CVE-2024-58318 A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for … Xperience after 13.0.162 Fix from $1,6002025-12-18 MEDIUM 6.1 CVE-2024-58319 A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget confi… Xperience after 13.0.160 Fix from $1,6002025-12-18 MEDIUM 5.3 CVE-2024-58317 A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies vi… Xperience after 13.0.164 Fix from $1,6002025-12-18 MEDIUM 5.3 CVE-2024-58320 An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during… Xperience after 13.0.159 Fix from $1,6002025-12-18 HIGH 7.5 CVE-2023-53934 A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handl… Xperience after 12.0.98 Fix from $1,9502025-12-18 MEDIUM 5.4 CVE-2023-53736 A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration inte… Xperience after 13.0.120 Fix from $1,6002025-12-18 MEDIUM 5.4 CVE-2023-53738 A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Att… Xperience after 13.0.109 Fix from $1,6002025-12-18 HIGH 7.5 CVE-2022-50686 An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control er… Xperience after 12.0 Fix from $1,9502025-12-18 MEDIUM 6.5 CVE-2022-50682 A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing en… Xperience after 13.0.79 Fix from $1,6002025-12-18 MEDIUM 6.1 CVE-2022-50681 A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in t… Xperience after 13.0.88 Fix from $1,6002025-12-18 MEDIUM 6.1 CVE-2022-50684 An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form … Xperience after 13.0.71 Fix from $1,6002025-12-18 MEDIUM 5.4 CVE-2022-50683 A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration. Th… Xperience after 13.0.74 Fix from $1,6002025-12-18 MEDIUM 5.4 CVE-2022-50685 A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page … Xperience after 13.0.56 Fix from $1,6002025-12-18 HIGH 8.8 CVE-2021-47711 A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method par… Xperience after 13.0.52 Fix from $1,9502025-12-18 HIGH 7.5 CVE-2021-47712 A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms. The… Xperience after 12.0.102 Fix from $1,9502025-12-18 HIGH 7.2 CVE-2020-36890 An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized req… Xperience after 12.0.60 Fix from $1,9502025-12-18 MEDIUM 5.4 CVE-2020-36889 A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially… Xperience after 12.0.90 Fix from $1,6002025-12-18 MEDIUM 5.4 CVE-2020-36891 A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file ex… Xperience after 12.0.49 Fix from $1,6002025-12-18 HIGH 8.8 CVE-2019-25229 An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types… Xperience after 12.0.29 Fix from $1,9502025-12-18 MEDIUM 5.3 CVE-2019-25228 An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users int… Xperience after 12.0.47 Fix from $1,6002025-12-18 CRITICAL 9.8 CVE-2025-32370 Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is… Xperience 13.0.178+ Fix from $2,3002025-04-06 MEDIUM 5.4 CVE-2025-32369 Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media… Xperience 13.0.181+ Fix from $1,6002025-04-06 HIGH 8.7 CVE-2025-2794 An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Servic… Xperience after 13.0.180 Fix from $1,9502025-03-31 HIGH 7.2 CVE-2025-2749 KEV An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative … Xperience after 13.0.178 Fix from $1,9502025-03-24 MEDIUM 6.1 CVE-2025-2748EPSS 59% The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for store… Xperience after 13.0.178 Fix from $1,6002025-03-24 CRITICAL 9.8 CVE-2025-2746 KEVEPSS 58% An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 … Xperience after 13.0.172 Fix from $2,3002025-03-24