XP
Product
Xperience
On CISA KEVExploited in the wild
51
CVEs
4
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 14Medium 31Low 0
Watch
Add Xperience to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-2747 In wildKEV | 9.8 | Mar 24 | Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass Affected: through 13.0.178 |
| CVE-2025-2746 In wildKEV | 9.8 | Mar 24 | Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass Affected: through 13.0.172 |
| CVE-2019-10068 In wildKEV | 9.8 | Mar 26 | Kentico Xperience Deserialization of Untrusted Data Vulnerability Affected: 9.0.0 through 9.0.51; 10.0.0 before 10.0.52; 11.0.0 before 11.0.48; 12.0.0 before 12.0.15 |
| CVE-2025-2749 In wildKEV | 7.2 | Mar 24 | Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE Affected: through 13.0.178 |
| CVE-2025-32370 | 9.8 | Apr 6 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through… Affected: before 13.0.178 |
| CVE-2017-17736 | 9.8 | Mar 23 | Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS… Affected: 9.0 before 9.0.51; 10.0 before 10.0.48 |
| CVE-2019-12102 | 9.1 | May 22 | Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx… Affected: 11.0.0 through 12.0 |
| CVE-2021-47711 | 8.8 | Dec 18 | A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters Affected: through 13.0.52 |
| CVE-2019-25229 | 8.8 | Dec 18 | An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader… Affected: through 12.0.29 |
| CVE-2018-19453 | 8.8 | Apr 10 | Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type Affected: before 11.0.45 |
| CVE-2025-2794 | 8.7 | Mar 31 | An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition Affected: through 13.0.180 |
| CVE-2018-5282 | 7.8 | Jan 8 | Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document Affected: 9.0 through 11.0 |
| CVE-2023-53934 | 7.5 | Dec 18 | A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler Affected: through 12.0.98 |
| CVE-2022-50686 | 7.5 | Dec 18 | An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages Affected: through 12.0 |
| CVE-2021-47712 | 7.5 | Dec 18 | A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms Affected: through 12.0.102 |
| CVE-2022-32387 | 7.5 | Jul 18 | In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler Affected: before 13.0.66 |
| CVE-2020-36890 | 7.2 | Dec 18 | An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests Affected: through 12.0.60 |
| CVE-2019-6242 | 7.2 | Feb 8 | Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page Affected: 10.0.42 |
| CVE-2018-6843 | 7.2 | Mar 19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface Affected: 10.0 before 10.0.50; 11.0 before 11.0.3 |
| CVE-2018-7046 | 7.2 | Feb 20 | Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation… Affected: 9.0 through 11.0 |
| CVE-2022-50682 | 6.5 | Dec 18 | A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine Affected: through 13.0.79 |
| CVE-2024-58319 | 6.1 | Dec 18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog Affected: through 13.0.160 |
| CVE-2024-58318 | 6.1 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and form builders Affected: through 13.0.162 |
| CVE-2022-50684 | 6.1 | Dec 18 | An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields Affected: through 13.0.71 |
| CVE-2022-50681 | 6.1 | Dec 18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich text editor component Affected: through 13.0.88 |
| CVE-2025-2748 | 6.1 | Mar 24 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects… Affected: through 13.0.178 |
| CVE-2021-46163 | 6.1 | Jan 10 | Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem Affected: 13.0.44 |
| CVE-2020-24794 | 6.1 | Sep 9 | Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75 Affected: before 12.0.75 |
| CVE-2025-5591 | 5.4 | Jan 5 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in… Affected: 13.0.0 before 13.0.167 |
| CVE-2024-58323 | 5.4 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component Affected: through 13.0.158 |
| CVE-2024-58322 | 5.4 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration Affected: through 13.0.158 |
| CVE-2024-58321 | 5.4 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration Affected: through 13.0.159 |
| CVE-2023-53738 | 5.4 | Dec 18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs Affected: through 13.0.109 |
| CVE-2023-53736 | 5.4 | Dec 18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface Affected: through 13.0.120 |
| CVE-2022-50685 | 5.4 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachments or metafiles Affected: through 13.0.56 |
| CVE-2022-50683 | 5.4 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration Affected: through 13.0.74 |
| CVE-2020-36891 | 5.4 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions Affected: through 12.0.49 |
| CVE-2020-36889 | 5.4 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names Affected: through 12.0.90 |
| CVE-2025-32369 | 5.4 | Apr 6 | Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature Affected: before 13.0.181 |
| CVE-2021-43991 | 5.4 | Dec 3 | The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS) Affected: 13.0.0 through 13.0.43 |
| CVE-2019-19493 | 5.4 | Dec 2 | Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS Affected: 9.0 before 12.0.50 |
| CVE-2018-6842 | 5.4 | Mar 19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page Affected: 10.0 before 10.0.50; 11.0 before 11.0.3 |
| CVE-2024-58320 | 5.3 | Dec 18 | An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication Affected: through 13.0.159 |
| CVE-2024-58317 | 5.3 | Dec 18 | A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config Affected: through 13.0.164 |
| CVE-2019-25228 | 5.3 | Dec 18 | An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains Affected: through 12.0.47 |
| CVE-2022-29287 | 4.9 | Apr 16 | Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability Affected: before 13.0.66 |
| CVE-2023-53737 | 4.8 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application Affected: through 13.0.101 |
| CVE-2022-50680 | 4.8 | Dec 18 | A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates Affected: through 13.0.92 |
| CVE-2018-7205 | 4.8 | Feb 20 | Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious… Affected: 9.0 through 11.0 |
| CVE-2026-105046 | 4.3 | Oct 2 | Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints Affected: 13.0.0 before 13.0.216 |