Advisories · Technology
Kentico Xperience.
Every CVE that names Kentico Xperience among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Forced browsing in Kentico Xperience
- Kentico Xperience
- Broken access control
- CVSS 7.7 High
Stored Cross-site Scripting (XSS) in Kentico Xperience 13
- Kentico Xperience
- Cross-site scripting (XSS)
- CWE-1188
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.158 Shipping Options Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.159 Form Validation Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Kentico Xperience <= 13.0.159 Authentication Information Disclosure
- Kentico Xperience
- Information disclosure
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Kentico Xperience <= 13.0.164 Cookie Security Configuration
- Kentico Xperience
- CWE-614
- CVSS 8.7 High
Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service
- Kentico Xperience
- CWE-97
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.109 Page Preview Reflected XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.101 Localization Application Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure
- Kentico Xperience
- Information disclosure
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.56 File Upload Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.71 Form Emails HTML Injection
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.74 Form Configuration Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection
- Kentico Xperience
- Other injection
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Kentico Xperience <= 13.0.92 Email Marketing Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability
- Kentico Xperience
- Weak cryptography or TLS
- CVSS 8.7 High
Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection
- Kentico Xperience
- SQL injection
- CVSS 5.1 Medium
Kentico Xperience <= 12.0.49 File Upload Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 8.6 High
Kentico Xperience <= 10 Administrator Access Control Bypass
- Kentico Xperience
- Broken access control
- CVSS 5.1 Medium
Kentico Xperience <= 12.0.90 Administration Interface Stored XSS
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Kentico Xperience <= 12.0.0 User Widget Information Disclosure
- Kentico Xperience
- Information disclosure
- CVSS 8.7 High
Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload
- Kentico Xperience
- Unrestricted file upload
- CVSS 5.1 Medium
Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure
- Kentico Xperience
- Information disclosure
- CVSS 7.2 High
Kentico Xperience: Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file…
- Kentico Xperience
- CWE-912
- CVSS 6.4 Medium
Cross-site scripting in Kentico Xperience
- Kentico Xperience
- Cross-site scripting (XSS)
- CVSS 8.7 High
Kentico Xperience <= 13.0.180 Unsafe Reflection
- Kentico Xperience
- Code injection
- CVSS 6.1 Medium
Kentico Xperience stored cross-site scripting in multiple-file upload functionality
- Kentico Xperience
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 7.2 HighCritical · KEVKEV
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
- Kentico Xperience
- Path traversal
- Unrestricted file upload
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
- Kentico Xperience
- Authentication bypass
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
- Kentico Xperience
- Authentication bypass