XP
Product
Xperience
On CISA KEVExploited in the wild
51
CVEs
4
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 14Medium 31Low 0
Watch
Add Xperience to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-2747 In wildKEV | 9.8 | Mar 24 | Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass Affected: through 13.0.178 |
| CVE-2025-2746 In wildKEV | 9.8 | Mar 24 | Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass Affected: through 13.0.172 |
| CVE-2019-10068 In wildKEV | 9.8 | Mar 26 | Kentico Xperience Deserialization of Untrusted Data Vulnerability Affected: 9.0.0 through 9.0.51; 10.0.0 before 10.0.52; 11.0.0 before 11.0.48; 12.0.0 before 12.0.15 |
| CVE-2025-32370 | 9.8 | Apr 6 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through… Affected: before 13.0.178 |
| CVE-2017-17736 | 9.8 | Mar 23 | Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS… Affected: 9.0 before 9.0.51; 10.0 before 10.0.48 |
| CVE-2019-12102 | 9.1 | May 22 | Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx… Affected: 11.0.0 through 12.0 |
Showing 6