Skip to content
Noroxi

Kentico records

53 published records for vendor Kentico. 4 of them have been exploited in the wild (listed in CISA KEV) and 4 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
4 · 7.5%
Weaponized
4 · 7.5%
Pre-auth RCE
4
With a fix record
0%
Median publish → KEV
301 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

53 records
  • CVE-2025-2747
    98Now

    Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    kentico · xperienceMar 24, 2025

  • CVE-2019-10068
    98Now

    An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions.

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    kentico · xperienceMar 26, 2019

  • CVE-2025-2746
    91Now

    Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass

    CriticalCVSS 9.8KEVWeaponizedEPSS 74%

    kentico · xperienceMar 24, 2025

  • CVE-2017-17736
    60This week

    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/insta

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    kentico · xperienceMar 23, 2018

  • CVE-2025-2749
    59Plan

    Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE

    HighCVSS 7.2KEVWeaponizedEPSS 4%

    kentico · xperienceMar 24, 2025

  • CVE-2025-2748
    42Plan

    Kentico Xperience stored cross-site scripting in multiple-file upload functionality

    MediumCVSS 6.1Proof of conceptEPSS 60%

    kentico · xperienceMar 24, 2025

  • CVE-2021-27581
    40Plan

    The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    kentico · kentico cmsMar 5, 2021

  • CVE-2025-32370
    39Monitor

    Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becaus

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    kentico · xperienceApr 6, 2025

  • CVE-2019-12102
    37Monitor

    Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselect

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    kentico · xperienceMay 22, 2019

  • CVE-2018-19453
    35Monitor

    Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.

    HighCVSS 8.8No exploitEPSS 1%

    kentico · xperienceApr 10, 2019

  • CVE-2025-2794
    34Monitor

    Kentico Xperience <= 13.0.180 Unsafe Reflection

    HighCVSS 8.7No exploitEPSS 0%

    kentico · xperienceMar 31, 2025

  • CVE-2023-53934
    34Monitor

    Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service

    HighCVSS 8.7No exploitEPSS 0%

    kentico · xperienceDec 18, 2025

  • CVE-2020-36890
    34Monitor

    Kentico Xperience <= 10 Administrator Access Control Bypass

    HighCVSS 8.6No exploitEPSS 0%

    kentico · xperienceDec 18, 2025

  • CVE-2019-25229
    34Monitor

    Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload

    HighCVSS 8.7No exploitEPSS 0%

    kentico · xperienceDec 18, 2025

  • CVE-2021-47711
    34Monitor

    Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection

    HighCVSS 8.7No exploitEPSS 0%

    kentico · xperienceDec 18, 2025

  • CVE-2018-5282
    31Monitor

    Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstal

    HighCVSS 7.8Proof of conceptEPSS 1%

    kentico · xperienceJan 8, 2018

  • CVE-2018-7046
    30Monitor

    Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system comma

    HighCVSS 7.2No exploitEPSS 5%

    kentico · xperienceFeb 20, 2018

  • CVE-2022-32387
    30Monitor

    In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler.

    HighCVSS 7.5No exploitEPSS 1%

    kentico · xperienceJul 18, 2022

  • CVE-2025-5591
    30Monitor

    Stored Cross-site Scripting (XSS) in Kentico Xperience 13

    HighCVSS 7.7No exploitEPSS 0%

    kentico · xperienceJan 5, 2026

  • CVE-2019-6242
    28Monitor

    Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page.

    HighCVSS 7.2No exploitEPSS 1%

    kentico · xperienceFeb 8, 2019

  • CVE-2018-6843
    28Monitor

    Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.

    HighCVSS 7.2No exploitEPSS 1%

    kentico · xperienceMar 19, 2018

  • CVE-2022-50686
    27Monitor

    Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure

    MediumCVSS 6.9No exploitEPSS 0%

    kentico · xperienceDec 18, 2025

  • CVE-2024-58320
    27Monitor

    Kentico Xperience <= 13.0.159 Authentication Information Disclosure

    MediumCVSS 6.9No exploitEPSS 0%

    kentico · xperienceDec 18, 2025

  • CVE-2021-47712
    27Monitor

    Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability

    MediumCVSS 6.9No exploitEPSS 0%

    kentico · xperienceDec 18, 2025

  • CVE-2022-50682
    27Monitor

    Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection

    MediumCVSS 6.9No exploitEPSS 0%

    kentico · xperienceDec 18, 2025