Vulnerability · Published Dec 18, 2025 · Assigned by VulnCheck
CVE-2021-47711Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection
High 8.8
In plain English
A high-severity SQL injection in Xperience from Kentico. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 77.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Kentico DevNet Hotfixes vendor-advisory, patch
- VulnCheck Advisory: Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection third-party-advisory