Kentico
Kentico Xperience: vulnerabilidades y CVE
Kentico Xperience tiene 51 vulnerabilidades publicadas, 28 de ellas en los últimos 12 meses. 6 son críticas y 4 figuran en el catálogo de explotación activa de CISA.
CVE51
Últimos 12 meses28
Críticas6
Explotadas activamente4
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-2749 | Alta (7.2) | 4.1% | ⚠ Explotación activa | 24 mar 2025 | An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload,… |
| CVE-2025-2746 | Crítica (9.8) | 73% | ⚠ Explotación activa | 24 mar 2025 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an… |
| CVE-2025-2747 | Crítica (9.8) | 97% | ⚠ Explotación activa | 24 mar 2025 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker… |
| CVE-2019-10068 | Crítica (9.8) | 95% | ⚠ Explotación activa | 26 mar 2019 | An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-105046 | Media (4.3) | 0.17% | — | 2 oct 2026 | Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints. |
| CVE-2025-5591 | Alta (7.7) | 0.17% | — | 5 ene 2026 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context. |
| CVE-2024-58323 | Media (5.1) | 0.17% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows malicious scripts to execute in users' browsers by exploiting… |
| CVE-2024-58322 | Media (5.1) | 0.17% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead to potential theft of sensitive data by executing malicious… |
| CVE-2024-58321 | Media (5.1) | 0.17% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers can exploit this vulnerability to execute malicious scripts… |
| CVE-2024-58320 | Media (6.9) | 0.27% | — | 18 dic 2025 | An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication. Attackers can retrieve confidential hostname… |
| CVE-2024-58319 | Media (5.1) | 0.19% | — | 18 dic 2025 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog. Attackers can exploit this vulnerability to execute… |
| CVE-2024-58318 | Media (5.1) | 0.17% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and form builders. Attackers can exploit this vulnerability by… |
| CVE-2024-58317 | Media (6.9) | 0.19% | — | 18 dic 2025 | A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by… |
| CVE-2023-53934 | Alta (8.7) | 0.43% | — | 18 dic 2025 | A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially… |
| CVE-2023-53738 | Media (5.1) | 0.20% | — | 18 dic 2025 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can exploit this vulnerability to execute arbitrary scripts in… |
| CVE-2023-53737 | Media (5.1) | 0.17% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. Attackers can execute scripts that could affect multiple parts… |
| CVE-2023-53736 | Media (5.1) | 0.20% | — | 18 dic 2025 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary… |
| CVE-2022-50686 | Media (6.9) | 0.31% | — | 18 dic 2025 | An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages. Detailed error messages can expose internal system… |
| CVE-2022-50685 | Media (5.1) | 0.17% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachments or metafiles. Attackers can upload malicious XML files… |
| CVE-2022-50684 | Media (5.1) | 0.20% | — | 18 dic 2025 | An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields. Unencoded form values could enable HTML content execution in… |
| CVE-2022-50683 | Media (5.1) | 0.17% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration. This allows malicious scripts to execute in users' browsers through… |
| CVE-2022-50682 | Media (6.9) | 0.21% | — | 18 dic 2025 | A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine. This could enable header injection and potentially facilitate… |
| CVE-2022-50681 | Media (5.1) | 0.22% | — | 18 dic 2025 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich text editor component. Attackers can exploit this… |
| CVE-2022-50680 | Media (5.1) | 0.21% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates. Attackers can exploit this vulnerability to execute malicious… |
| CVE-2021-47712 | Media (6.9) | 0.24% | — | 18 dic 2025 | A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms. The hotfix introduces an additional security layer to prevent hash value… |
| CVE-2021-47711 | Alta (8.7) | 0.30% | — | 18 dic 2025 | A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data… |
| CVE-2020-36891 | Media (5.1) | 0.22% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading… |
| CVE-2020-36890 | Alta (8.6) | 0.34% | — | 18 dic 2025 | An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator… |
| CVE-2020-36889 | Media (5.1) | 0.22% | — | 18 dic 2025 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names. This allows malicious scripts to execute in… |
| CVE-2019-25230 | Media (5.3) | 0.27% | — | 18 dic 2025 | An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget properties dialog. Attackers can exploit this vulnerability to access… |
| CVE-2019-25229 | Alta (8.7) | 0.34% | — | 18 dic 2025 | An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file… |
| CVE-2019-25228 | Media (5.1) | 0.30% | — | 18 dic 2025 | An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information… |
| CVE-2025-32370 | Crítica (9.8) | 1.5% | — | 6 abr 2025 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional… |
| CVE-2025-32369 | Media (5.4) | 0.27% | — | 6 abr 2025 | Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.