# cve.now: Kentico

The newest entries naming Kentico as an affected vendor (up to 200), of 38 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-105046](https://cve.now/CVE-2026-105046.md): Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints. (CVSS 4.3)
- [CVE-2025-5591](https://cve.now/CVE-2025-5591.md): Stored Cross-site Scripting (XSS) in Kentico Xperience 13 (CVSS 7.7)
- [CVE-2024-58323](https://cve.now/CVE-2024-58323.md): Kentico Xperience \<= 13.0.158 Checkbox Form Component Stored XSS (CVSS 5.1)
- [CVE-2024-58322](https://cve.now/CVE-2024-58322.md): Kentico Xperience \<= 13.0.158 Shipping Options Stored XSS (CVSS 5.1)
- [CVE-2024-58321](https://cve.now/CVE-2024-58321.md): Kentico Xperience \<= 13.0.159 Form Validation Stored XSS (CVSS 5.1)
- [CVE-2024-58320](https://cve.now/CVE-2024-58320.md): Kentico Xperience \<= 13.0.159 Authentication Information Disclosure (CVSS 6.9)
- [CVE-2024-58319](https://cve.now/CVE-2024-58319.md): Kentico Xperience \<= 13.0.160 Pages Dashboard Widget Reflected XSS (CVSS 5.1)
- [CVE-2024-58318](https://cve.now/CVE-2024-58318.md): Kentico Xperience \<= 13.0.162 Rich Text Editor Stored XSS (CVSS 5.1)
- [CVE-2024-58317](https://cve.now/CVE-2024-58317.md): Kentico Xperience \<= 13.0.164 Cookie Security Configuration (CVSS 6.9)
- [CVE-2023-53934](https://cve.now/CVE-2023-53934.md): Kentico Xperience \<= 12.0.98 GetResource Handler Denial of Service (CVSS 8.7)
- [CVE-2023-53738](https://cve.now/CVE-2023-53738.md): Kentico Xperience \<= 13.0.109 Page Preview Reflected XSS (CVSS 5.1)
- [CVE-2023-53737](https://cve.now/CVE-2023-53737.md): Kentico Xperience \<= 13.0.101 Localization Application Stored XSS (CVSS 5.1)
- [CVE-2023-53736](https://cve.now/CVE-2023-53736.md): Kentico Xperience \<= 13.0.120 Administration Interface Reflected XSS (CVSS 5.1)
- [CVE-2022-50686](https://cve.now/CVE-2022-50686.md): Kentico Xperience \<= 12.0 Portal Engine Form Control Information Disclosure (CVSS 6.9)
- [CVE-2022-50685](https://cve.now/CVE-2022-50685.md): Kentico Xperience \<= 13.0.56 File Upload Stored XSS (CVSS 5.1)
- [CVE-2022-50684](https://cve.now/CVE-2022-50684.md): Kentico Xperience \<= 13.0.71 Form Emails HTML Injection (CVSS 5.1)
- [CVE-2022-50683](https://cve.now/CVE-2022-50683.md): Kentico Xperience \<= 13.0.74 Form Configuration Stored XSS (CVSS 5.1)
- [CVE-2022-50682](https://cve.now/CVE-2022-50682.md): Kentico Xperience \<= 13.0.79 Routing Engine CRLF Injection (CVSS 6.9)
- [CVE-2022-50681](https://cve.now/CVE-2022-50681.md): Kentico Xperience \<= 13.0.88 Rich Text Editor Reflected XSS (CVSS 5.1)
- [CVE-2022-50680](https://cve.now/CVE-2022-50680.md): Kentico Xperience \<= 13.0.92 Email Marketing Stored XSS (CVSS 5.1)
- [CVE-2021-47712](https://cve.now/CVE-2021-47712.md): Kentico Xperience \<= 12.0.102 URL Hashing Cryptography Vulnerability (CVSS 6.9)
- [CVE-2021-47711](https://cve.now/CVE-2021-47711.md): Kentico Xperience \<= 13.0.52 Online Marketing Macros SQL Injection (CVSS 8.7)
- [CVE-2020-36891](https://cve.now/CVE-2020-36891.md): Kentico Xperience \<= 12.0.49 File Upload Stored XSS (CVSS 5.1)
- [CVE-2020-36890](https://cve.now/CVE-2020-36890.md): Kentico Xperience \<= 10 Administrator Access Control Bypass (CVSS 8.6)
- [CVE-2020-36889](https://cve.now/CVE-2020-36889.md): Kentico Xperience \<= 12.0.90 Administration Interface Stored XSS (CVSS 5.1)
- [CVE-2019-25230](https://cve.now/CVE-2019-25230.md): Kentico Xperience \<= 12.0.0 User Widget Information Disclosure (CVSS 5.3)
- [CVE-2019-25229](https://cve.now/CVE-2019-25229.md): Kentico Xperience \<= 12.0.29 MVC Forms Unrestricted File Upload (CVSS 8.7)
- [CVE-2019-25228](https://cve.now/CVE-2019-25228.md): Kentico Xperience \<= 12.0.47 Virtual Context Information Disclosure (CVSS 5.1)
- [CVE-2025-32370](https://cve.now/CVE-2025-32370.md): Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becaus (CVSS 7.2)
- [CVE-2025-32369](https://cve.now/CVE-2025-32369.md): Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with (CVSS 6.4)
- [CVE-2025-2794](https://cve.now/CVE-2025-2794.md): Kentico Xperience \<= 13.0.180 Unsafe Reflection (CVSS 8.7)
- [CVE-2025-2878](https://cve.now/CVE-2025-2878.md): Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting (CVSS 4.8)
- [CVE-2025-2748](https://cve.now/CVE-2025-2748.md): Kentico Xperience stored cross-site scripting in multiple-file upload functionality (CVSS 6.1)
- [CVE-2025-2749](https://cve.now/CVE-2025-2749.md): Kentico Xperience \<= 13.0.178 Staging Media File Upload Authenticated RCE (CVSS 7.2, KEV)
- [CVE-2025-2747](https://cve.now/CVE-2025-2747.md): Kentico Xperience \<= 13.0.178 Staging Sync Server None Password Type Authentication Bypass (CVSS 9.8, KEV)
- [CVE-2025-2746](https://cve.now/CVE-2025-2746.md): Kentico Xperience \<= 13.0.172 Staging Sync Server Digest Password Authentication Bypass (CVSS 9.8, KEV)
- [CVE-2024-12907](https://cve.now/CVE-2024-12907.md): XSS in Kentico 7 (CVSS 5.3)
- [CVE-2021-43991](https://cve.now/CVE-2021-43991.md): Persistent XSS via Avatar Upload in Kentico Xperience CMS (CVSS 6.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/kentico
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.