KE
Vendor
Kentico
59
CVEs
7
On KEV
1
New 30D
Products
XP9.8
Xperience
Kentico
51 CVEs4 on KEV1 new
XC9.8
Xperience CMS
Kentico
2 CVEs2 on KEV0 new
KX7.2
Kentico Xperience
Kentico
2 CVEs1 on KEV0 new
KC9.8
Kentico CMS
Kentico
4 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105046 | XP Xperience Kentico | 4.3 | Oct 2 | Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints |
| CVE-2025-5591 | KX Kentico Xperience Kentico | 5.4 | Jan 5 | Stored Cross-site Scripting (XSS) in Kentico Xperience 13 |
| CVE-2024-58323 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS |
| CVE-2024-58322 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 13.0.158 Shipping Options Stored XSS |
| CVE-2024-58321 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 13.0.159 Form Validation Stored XSS |
| CVE-2024-58320 | XP Xperience Kentico | 5.3 | Dec 18 | Kentico Xperience <= 13.0.159 Authentication Information Disclosure |
| CVE-2024-58319 | XP Xperience Kentico | 6.1 | Dec 18 | Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS |
| CVE-2024-58318 | XP Xperience Kentico | 6.1 | Dec 18 | Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS |
| CVE-2024-58317 | XP Xperience Kentico | 5.3 | Dec 18 | Kentico Xperience <= 13.0.164 Cookie Security Configuration |
| CVE-2023-53934 | XP Xperience Kentico | 7.5 | Dec 18 | Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service |
| CVE-2023-53738 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 13.0.109 Page Preview Reflected XSS |
| CVE-2023-53737 | XP Xperience Kentico | 4.8 | Dec 18 | Kentico Xperience <= 13.0.101 Localization Application Stored XSS |
| CVE-2023-53736 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS |
| CVE-2022-50686 | XP Xperience Kentico | 7.5 | Dec 18 | Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure |
| CVE-2022-50685 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 13.0.56 File Upload Stored XSS |
| CVE-2022-50684 | XP Xperience Kentico | 6.1 | Dec 18 | Kentico Xperience <= 13.0.71 Form Emails HTML Injection |
| CVE-2022-50683 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 13.0.74 Form Configuration Stored XSS |
| CVE-2022-50682 | XP Xperience Kentico | 6.5 | Dec 18 | Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection |
| CVE-2022-50681 | XP Xperience Kentico | 6.1 | Dec 18 | Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS |
| CVE-2022-50680 | XP Xperience Kentico | 4.8 | Dec 18 | Kentico Xperience <= 13.0.92 Email Marketing Stored XSS |
| CVE-2021-47712 | XP Xperience Kentico | 7.5 | Dec 18 | Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability |
| CVE-2021-47711 | XP Xperience Kentico | 8.8 | Dec 18 | Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection |
| CVE-2020-36891 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 12.0.49 File Upload Stored XSS |
| CVE-2020-36890 | XP Xperience Kentico | 7.2 | Dec 18 | Kentico Xperience <= 10 Administrator Access Control Bypass |
| CVE-2020-36889 | XP Xperience Kentico | 5.4 | Dec 18 | Kentico Xperience <= 12.0.90 Administration Interface Stored XSS |
| CVE-2019-25230 | XP Xperience Kentico | 4.3 | Dec 18 | Kentico Xperience <= 12.0.0 User Widget Information Disclosure |
| CVE-2019-25229 | XP Xperience Kentico | 8.8 | Dec 18 | Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload |
| CVE-2019-25228 | XP Xperience Kentico | 5.3 | Dec 18 | Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure |
| CVE-2025-32370 | XP Xperience Kentico | 9.8 | Apr 6 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through… |
| CVE-2025-32369 | XP Xperience Kentico | 5.4 | Apr 6 | Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature |
| CVE-2025-2794 | XP Xperience Kentico | 8.7 | Mar 31 | An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition |
| CVE-2025-2748 | XP Xperience Kentico | 6.1 | Mar 24 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects… |
| CVE-2025-2749 In wildKEV | XP Xperience Kentico | 7.2 | Mar 24 | Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE |
| CVE-2025-2747 In wildKEV | XP Xperience Kentico | 9.8 | Mar 24 | Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass |
| CVE-2025-2746 In wildKEV | XP Xperience Kentico | 9.8 | Mar 24 | Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass |
| CVE-2024-12907 | KC Kentico CMS Kentico | 5.3 | Jan 2 | XSS in Kentico 7 |
| CVE-2022-32387 | XP Xperience Kentico | 7.5 | Jul 18 | In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler |
| CVE-2022-29287 | XP Xperience Kentico | 4.9 | Apr 16 | Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability |
| CVE-2021-46163 | XP Xperience Kentico | 6.1 | Jan 10 | Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem |
| CVE-2021-43991 | XP Xperience Kentico | 5.4 | Dec 3 | The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS) |
| CVE-2021-27581 | KC Kentico Cms Kentico | 9.8 | Mar 5 | The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter |
| CVE-2020-24794 | XP Xperience Kentico | 6.1 | Sep 9 | Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75 |
| CVE-2019-19493 | XP Xperience Kentico | 5.4 | Dec 2 | Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS |
| CVE-2019-12102 | XP Xperience Kentico | 9.1 | May 22 | Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx… |
| CVE-2018-19453 | XP Xperience Kentico | 8.8 | Apr 10 | Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type |
| CVE-2019-10068 In wildKEV | XP Xperience Kentico | 9.8 | Mar 26 | Kentico Xperience Deserialization of Untrusted Data Vulnerability |
| CVE-2019-6242 | XP Xperience Kentico | 7.2 | Feb 8 | Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page |
| CVE-2017-17736 | XP Xperience Kentico | 9.8 | Mar 23 | Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS… |
| CVE-2018-6843 | XP Xperience Kentico | 7.2 | Mar 19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface |
| CVE-2018-6842 | XP Xperience Kentico | 5.4 | Mar 19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page |
| CVE-2018-7205 | XP Xperience Kentico | 4.8 | Feb 20 | Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious… |
| CVE-2018-7046 | XP Xperience Kentico | 7.2 | Feb 20 | Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation… |
| CVE-2018-5282 | XP Xperience Kentico | 7.8 | Jan 8 | Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document |
| CVE-2015-7823 | KC Kentico Cms Kentico | – | Oct 21 | Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing… |
| CVE-2015-7822 | KC Kentico Cms Kentico | – | Oct 21 | Multiple cross-site scripting (XSS) vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter name to… |