Kentico vulnerabilities
38 published CVEs name Kentico among the affected products; CISA lists 3 of them as exploited in the wild.
- Published CVEs
- 38
- Last 12 months
- 28
- Critical
- 2
- Known exploited
- 3
Critical 2High 8Medium 28Low 0Not scored 0
CVEs per yearBy the year they were published
- 20211
- 202535
- 20262
Known exploitedNewest addition to KEV first
- CVE-2025-2749
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
Kentico · Xperience
ExploitedHigh7.2 - CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8 - CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8
Newest CVEs
- CVE-2026-105046
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
Kentico · Xperience
Medium4.3 - CVE-2025-5591
Stored Cross-site Scripting (XSS) in Kentico Xperience 13
Kentico · Kentico Xperience
High7.7 - CVE-2024-58323
Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS
Kentico · Xperience
Medium5.1 - CVE-2024-58322
Kentico Xperience <= 13.0.158 Shipping Options Stored XSS
Kentico · Xperience
Medium5.1 - CVE-2024-58321
Kentico Xperience <= 13.0.159 Form Validation Stored XSS
Kentico · Xperience
Medium5.1 - CVE-2024-58320
Kentico Xperience <= 13.0.159 Authentication Information Disclosure
Kentico · Xperience
Medium6.9 - CVE-2024-58319
Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS
Kentico · Xperience
Medium5.1 - CVE-2024-58318
Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS
Kentico · Xperience
Medium5.1 - CVE-2024-58317
Kentico Xperience <= 13.0.164 Cookie Security Configuration
Kentico · Xperience
Medium6.9 - CVE-2023-53934
Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service
Kentico · Xperience
High8.7