Kentico

Products

Exploited and recent CVEs

• CVE-2025-2749 High 7.2 Exploited Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE 4.0%
• CVE-2025-2747 Critical 9.8 Exploited Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass 97.2%
• CVE-2025-2746 Critical 9.8 Exploited Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass 74.1%
• CVE-2026-105046 Medium 4.3 Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints. 0.2%
• CVE-2025-5591 High 7.7 Stored Cross-site Scripting (XSS) in Kentico Xperience 13 0.2%
• CVE-2024-58323 Medium 5.4 Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS 0.2%
• CVE-2024-58322 Medium 5.4 Kentico Xperience <= 13.0.158 Shipping Options Stored XSS 0.2%
• CVE-2024-58321 Medium 5.4 Kentico Xperience <= 13.0.159 Form Validation Stored XSS 0.2%
• CVE-2024-58320 Medium 5.3 Kentico Xperience <= 13.0.159 Authentication Information Disclosure 0.3%
• CVE-2024-58319 Medium 6.1 Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS 0.2%
• CVE-2024-58318 Medium 6.1 Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS 0.2%
• CVE-2024-58317 Medium 5.3 Kentico Xperience <= 13.0.164 Cookie Security Configuration 0.2%
• CVE-2023-53934 High 7.5 Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service 0.4%
• CVE-2023-53738 Medium 5.4 Kentico Xperience <= 13.0.109 Page Preview Reflected XSS 0.2%
• CVE-2023-53737 Medium 4.8 Kentico Xperience <= 13.0.101 Localization Application Stored XSS 0.2%
• CVE-2023-53736 Medium 5.4 Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS 0.2%
• CVE-2022-50686 High 7.5 Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure 0.3%
• CVE-2022-50685 Medium 5.4 Kentico Xperience <= 13.0.56 File Upload Stored XSS 0.2%
• CVE-2022-50684 Medium 6.1 Kentico Xperience <= 13.0.71 Form Emails HTML Injection 0.2%
• CVE-2022-50683 Medium 5.4 Kentico Xperience <= 13.0.74 Form Configuration Stored XSS 0.2%
• CVE-2022-50682 Medium 6.5 Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection 0.2%
• CVE-2022-50681 Medium 6.1 Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS 0.2%
• CVE-2022-50680 Medium 4.8 Kentico Xperience <= 13.0.92 Email Marketing Stored XSS 0.2%
• CVE-2021-47712 High 7.5 Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability 0.2%
• CVE-2021-47711 High 8.8 Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection 0.3%
• CVE-2020-36891 Medium 5.4 Kentico Xperience <= 12.0.49 File Upload Stored XSS 0.2%
• CVE-2020-36890 High 7.2 Kentico Xperience <= 10 Administrator Access Control Bypass 0.3%
• CVE-2020-36889 Medium 5.4 Kentico Xperience <= 12.0.90 Administration Interface Stored XSS 0.2%
• CVE-2025-32369 Medium 6.4 Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature. 0.3%
• CVE-2025-32370 High 7.2 Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is add 1.6%