kentico-xperience13-AuthBypass-wt-2025-0006

WT-2025-0006 CVE は未割り当て Kentico Xperience 13 CMS - Staging Service 認証バイパスチェック 実行例 root@kitploit: python3 watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0006.py -H http://labcms / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / /...

Kentico - Installer Privilege Escalation

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard. id: CVE-2017-17736 info: name: Kentico - Installer...

Kentico Xperience CMS - Unauthenticated Stored XSS

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178. id: CVE-2025-2748 info: name: Kentico Xperience CMS - Unauthenticated Stored XSS author...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)

Before Kentico Xperience 13 Hotfix 173, this vulnerability can be exploited with any username provided. For Hotfix = 173 and = 173 and 178, this vulnerability can be exploited only if you provide a valid Staging Service username default: admin impact: | Unauthenticated attackers can bypass...

Kentico CMS 8.2 - Open Redirect

Kentico CMS 8.2 contains an open redirect vulnerability via GetDocLink.ashx with link variable. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. id: CVE-2015-7823 info: name: Kentico CMS 8.2 - Open Redirect author: 0xAkoko severity:...

kentico-xperience13-AuthBypass-wt-2025-0011

WT-2025-0011 CVE not assigned yet Kentico Xperience 13 CMS - Staging Service Authentication Bypass Check Detection in Action root@kitploit: python3 .\watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0011.py -H http://labcms -u admin / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | ...

Kentico CMS Insecure Deserialization Remote Code Execution

Kentico CMS is susceptible to remote code execution via a .NET deserialization vulnerability. id: CVE-2019-10068 info: name: Kentico CMS Insecure Deserialization Remote Code Execution author: davidmckennirey severity: critical description: Kentico CMS is susceptible to remote code execution via a...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

CVE-2019-12102-Scanner

Escáner CVE-2019-12102 El Escáner CVE-2019-12102 es una herramienta automatizada para detectar la vulnerabilidad de Carga de Archivos / Exposición de Archivos sin Autenticación en Kentico CMS versiones 11 a 12. Esta vulnerabilidad es causada por un control de acceso inadecuado en el endpoint...

Kentico-Xperience-before-13.0.178---XSS-POC

Este repositorio no tiene un README...

CVE-2019-10068-PoC

CVE-2019-10068 PoC for Kentico CMS Proof of concept exploit for CVE-2019-10068, leveraging a Deserialization RCE in Kentico CMS to upload a web shell. Legal Disclaimer: This proof-of-concept is provided for educational and authorised security research purposes only. The author is not responsible...

CVE-2019-10068-PoC

PoC de CVE-2019-10068 para Kentico CMS Exploit de prueba de concepto para CVE-2019-10068, que aprovecha una RCE por deserialización en Kentico CMS para subir una web shell. Aviso legal: Esta prueba de concepto se proporciona únicamente con fines educativos y de investigación de seguridad...

CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation. The list of vulnerabilities is as...

CISA Adds Eight Known Exploited Vulnerabilities to Catalog

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2023-27351link is external PaperCut NG/MF Improper Authentication Vulnerability CVE-2024-27199link is external JetBrains TeamCity Relative Path Traversal...

VulnCheck KEV: CVE-2025-2749

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code...

Kentico Xperience Path Traversal Vulnerability

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations...

Exploit for Deserialization of Untrusted Data in Kentico Xperience

CVE-2019-10...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05118)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of user-supplied data by a form component, which can be exploited by an attacker to execute arbitrary web...

CVE-2021-27581

The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter...

CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...