High severity · published Dec 18, 2025
CVE-2023-53934
A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through maliciously constructed requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XP
Xperience · Kentico
through 12.0.98 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53934
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-53934
Product
https://devnet.kentico.com/download/hotfixes
Third Party Advisory
https://www.vulncheck.com/advisories/kentico-xperience-getresource-handler-denial-of-service
More from Xperience
9.8
CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
9.8
CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
9.8
CVE-2019-10068
Kentico Xperience Deserialization of Untrusted Data Vulnerability
7.2
CVE-2025-2749
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
9.8
CVE-2025-32370
Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through…