Kentico-Xperience-before-13.0.178---XSS-POC

This repository does not have a README...

kentico-xperience13-AuthBypass-wt-2025-0006

WT-2025-0006 CVE not assigned yet Kentico Xperience 13 CMS - Staging Service Authentication Bypass Check Detection in Action python3 watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0006.py -H http://labcms / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // ||...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)

Before Kentico Xperience 13 Hotfix 173, this vulnerability can be exploited with any username provided. For Hotfix = 173 and = 173 and 178, this vulnerability can be exploited only if you provide a valid Staging Service username default: admin impact: | Unauthenticated attackers can bypass...

Kentico Xperience CMS - Unauthenticated Stored XSS

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178. id: CVE-2025-2748 info: name: Kentico Xperience CMS - Unauthenticated Stored XSS author...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

kentico-xperience13-AuthBypass-wt-2025-0011

WT-2025-0011 CVE not assigned yet Kentico Xperience 13 CMS - Staging Service Authentication Bypass Check Detection in Action python3 .\watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0011.py -H http://labcms -u admin / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | |...

EUVD-2026-91832

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046

Kentico Xperience 13 versions prior to 13.0.216 are vulnerable to an object-level authorization deficiency. The issue stems from a lack of proper authorization checks for administration API endpoints , which may allow unauthorized access to administrative functions. Specific details regarding the...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

PT-2026-104450

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046: Direct Request

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

Kentico Xperience 13 CMS - Staging None-password Authentication Bypass

Kentico Staging SyncServer None-type password handling auth bypass WT-2025-0006. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging None-password Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation. The list of vulnerabilities is as...

VulnCheck KEV: CVE-2025-2749

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code...

Kentico Xperience Path Traversal Vulnerability

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations...

Exploit for Deserialization of Untrusted Data in Kentico Xperience

CVE-2019-10...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05118)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of user-supplied data by a form component, which can be exploited by an attacker to execute arbitrary web...

CVE-2025-5591

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context...