CVE-2019-10068-PoC

针对 Kentico CMS 的 CVE-2019-10068 PoC 针对 CVE-2019-10068 的概念验证利用，利用 Kentico CMS 中的反序列化 RCE 漏洞上传 Web Shell。 法律免责声明： 本概念验证仅用于教育和授权安全研究目的。作者不对因使用此代码而造成的任何滥用或损害负责，请仅在您拥有或已获得明确许可测试的系统上使用，并确保遵守所有适用法律。 用法 1. 在 第 9 行 修改脚本中的目标系统 URL（格式为 https://target.com）。 2. 在终端中运行脚本：python3 cve-2019-10068-poc.py。 3. 在目标上验...

CVE-2019-12102-Scanner

CVE-2019-12102 스캐너 CVE-2019-12102 스캐너 는 Kentico CMS 버전 1112에서 발생하는 인증되지 않은 파일 업로드 / 파일 노출 취약점을 스캔하는 자동화 도구입니다. 이 취약점은 /cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx 엔드포인트에 대한 부적절한 접근 제어로 인해 발생합니다. 이 도구는 해당 엔드포인트의 응답을 확인하여 도메인이 취약한지 여부를 판단하고, 잠재적 취약 및 확인된 취약...

CVE-2021-27581

The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter...

EUVD-2018-11143

Malware in sbrugna...

EUVD-2021-14329

Malware in sbrugna...

EUVD-2015-7720

Malware in sbrugna...

EUVD-2015-7721

Malicious code in bioql PyPI...

EUVD-2024-51185

Malicious code in bioql PyPI...

EUVD-2022-33630

Malicious code in bioql PyPI...

EUVD-2025-8526

Malicious code in bioql PyPI...

CVE-2024-12907

Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint. Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this...

CVE-2022-29287

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights default is Administrator to export the user options of any user, even ones with higher privileges like Global Administrators than the current user. The exported XML...

CVE-2025-2878

A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database lea...

CVE-2025-2878

A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database lea...

CVE-2025-2878 Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting

A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database lea...

CVE-2025-2878 Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting

A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database lea...

CVE-2025-2878

CVE-2025-2878 affects Kentico CMS up to version 13.0.178. The vulnerability resides in the file /CMSInstall/install.aspx within the Additional Database Installation Wizard. By manipulating the argument new database, an attacker can trigger cross-site scripting (XSS). The issue can be exploited re...

CVE-2024-12907

Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint. Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this...

CVE-2024-12907 XSS in Kentico 7

Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint. Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this...

CVE-2024-12907

CVE-2024-12907 affects Kentico CMS 7, where a Reflected XSS can be triggered by manipulating a specific GET parameter sent to the /CMSMessages/AccessDenied.aspx endpoint. The description notes that Kentico 7 reached end of support in 2016, and Kentico 8 has been tested and does not contain this v...