Kentico vulnerabilities
38 CVEs and advisories name Kentico as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-105046Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
- CVE-2025-5591Stored Cross-site Scripting (XSS) in Kentico Xperience 13
- CVE-2024-58323Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS
- CVE-2024-58322Kentico Xperience <= 13.0.158 Shipping Options Stored XSS
- CVE-2024-58321Kentico Xperience <= 13.0.159 Form Validation Stored XSS
- CVE-2024-58320Kentico Xperience <= 13.0.159 Authentication Information Disclosure
- CVE-2024-58319Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS
- CVE-2024-58318Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS
- CVE-2024-58317Kentico Xperience <= 13.0.164 Cookie Security Configuration
- CVE-2023-53934Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service
- CVE-2023-53738Kentico Xperience <= 13.0.109 Page Preview Reflected XSS
- CVE-2023-53737Kentico Xperience <= 13.0.101 Localization Application Stored XSS
- CVE-2023-53736Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS
- CVE-2022-50686Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure
- CVE-2022-50685Kentico Xperience <= 13.0.56 File Upload Stored XSS
- CVE-2022-50684Kentico Xperience <= 13.0.71 Form Emails HTML Injection
- CVE-2022-50683Kentico Xperience <= 13.0.74 Form Configuration Stored XSS
- CVE-2022-50682Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection
- CVE-2022-50681Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS
- CVE-2022-50680Kentico Xperience <= 13.0.92 Email Marketing Stored XSS
- CVE-2021-47712Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability
- CVE-2021-47711Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection
- CVE-2020-36891Kentico Xperience <= 12.0.49 File Upload Stored XSS
- CVE-2020-36890Kentico Xperience <= 10 Administrator Access Control Bypass
- CVE-2020-36889Kentico Xperience <= 12.0.90 Administration Interface Stored XSS
- CVE-2019-25230Kentico Xperience <= 12.0.0 User Widget Information Disclosure
- CVE-2019-25229Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload
- CVE-2019-25228Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure
- CVE-2025-32370Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becaus
- CVE-2025-32369Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with