XP
Product
Xperience
On CISA KEVExploited in the wild
51
CVEs
4
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 14Medium 31Low 0
Watch
Add Xperience to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-2749 In wildKEV | 7.2 | Mar 24 | Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE Affected: through 13.0.178 |
| CVE-2021-47711 | 8.8 | Dec 18 | Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection Affected: through 13.0.52 |
| CVE-2019-25229 | 8.8 | Dec 18 | Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload Affected: through 12.0.29 |
| CVE-2018-19453 | 8.8 | Apr 10 | Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type Affected: before 11.0.45 |
| CVE-2025-2794 | 8.7 | Mar 31 | Kentico Xperience <= 13.0.180 Unsafe Reflection Affected: through 13.0.180 |
| CVE-2018-5282 | 7.8 | Jan 8 | Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document Affected: 9.0 through 11.0 |
| CVE-2023-53934 | 7.5 | Dec 18 | Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service Affected: through 12.0.98 |
| CVE-2022-50686 | 7.5 | Dec 18 | Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure Affected: through 12.0 |
| CVE-2021-47712 | 7.5 | Dec 18 | Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability Affected: through 12.0.102 |
| CVE-2022-32387 | 7.5 | Jul 18 | In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler Affected: before 13.0.66 |
| CVE-2020-36890 | 7.2 | Dec 18 | Kentico Xperience <= 10 Administrator Access Control Bypass Affected: through 12.0.60 |
| CVE-2019-6242 | 7.2 | Feb 8 | Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page Affected: 10.0.42 |
| CVE-2018-6843 | 7.2 | Mar 19 | Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface Affected: 10.0 before 10.0.50; 11.0 before 11.0.3 |
| CVE-2018-7046 | 7.2 | Feb 20 | Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation… Affected: 9.0 through 11.0 |
Showing 14