Kentico CMS Insecure Deserialization Remote Code Execution

Kentico CMS is susceptible to remote code execution via a .NET deserialization vulnerability. id: CVE-2019-10068 info: name: Kentico CMS Insecure Deserialization Remote Code Execution author: davidmckennirey severity: critical description: Kentico CMS is susceptible to remote code execution via a...

Kentico Xperience CMS - Unauthenticated Stored XSS

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178. id: CVE-2025-2748 info: name: Kentico Xperience CMS - Unauthenticated Stored XSS author...

Kentico - Installer Privilege Escalation

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard. id: CVE-2017-17736 info: name: Kentico - Installer...

Kentico CMS 8.2 - Open Redirect

Kentico CMS 8.2 contains an open redirect vulnerability via GetDocLink.ashx with link variable. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. id: CVE-2015-7823 info: name: Kentico CMS 8.2 - Open Redirect author: 0xAkoko severity:...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)

Before Kentico Xperience 13 Hotfix 173, this vulnerability can be exploited with any username provided. For Hotfix = 173 and = 173 and 178, this vulnerability can be exploited only if you provide a valid Staging Service username default: admin impact: | Unauthenticated attackers can bypass...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

CVE-2019-10068-PoC

针对 Kentico CMS 的 CVE-2019-10068 PoC 针对 CVE-2019-10068 的概念验证利用，利用 Kentico CMS 中的反序列化 RCE 漏洞上传 Web Shell。 法律免责声明： 本概念验证仅用于教育和授权安全研究目的。作者不对因使用此代码而造成的任何滥用或损害负责，请仅在您拥有或已获得明确许可测试的系统上使用，并确保遵守所有适用法律。 用法 1. 在 第 9 行 修改脚本中的目标系统 URL（格式为 https://target.com）。 2. 在终端中运行脚本：python3 cve-2019-10068-poc.py。 3. 在目标上验...

kentico-xperience13-AuthBypass-wt-2025-0006

WT-2025-0006 CVE 아직 할당되지 않음 Kentico Xperience 13 CMS - 스테이징 서비스 인증 우회 확인 실행 화면 root@kitploit: python3 watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0006.py -H http://labcms / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / / /...

kentico-xperience13-AuthBypass-wt-2025-0011

WT-2025-0011 CVE 미할당 Kentico Xperience 13 CMS - Staging Service 인증 우회 점검 실행 화면 root@kitploit: python3 .\watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0011.py -H http://labcms -u admin / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // ||...

CVE-2019-12102-Scanner

CVE-2019-12102 スキャナー CVE-2019-12102 スキャナー は、Kentico CMS バージョン 11 から 12 における認証なしファイルアップロード / ファイル露出 脆弱性をスキャンする自動化ツールです。この脆弱性は、エンドポイント /cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx に対する不適切なアクセス制御によって引き起こされます。ツールはエンドポイントからの応答を検証してドメインが脆弱かどうかを確認し、結果を潜在的に脆弱...

CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation. The list of vulnerabilities is as...

CISA Adds Eight Known Exploited Vulnerabilities to Catalog

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2023-27351link is external PaperCut NG/MF Improper Authentication Vulnerability CVE-2024-27199link is external JetBrains TeamCity Relative Path Traversal...

VulnCheck KEV: CVE-2025-2749

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code...

Kentico Xperience Path Traversal Vulnerability

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations...

Exploit for Deserialization of Untrusted Data in Kentico Xperience

CVE-2019-10...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05118)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of user-supplied data by a form component, which can be exploited by an attacker to execute arbitrary web...

CVE-2021-27581

The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter...

CVE-2019-12102

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions...

CVE-2025-5591

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context...

CVE-2025-5591

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context...