CVE-2017-17736

CVE-2017-17736 affects Kentico CMS: versions 9.0 up to 9.0.50 and 10.0 up to 10.0.47 are vulnerable to privilege escalation by visiting CMSInstall/install.aspx and navigating to the CMS Administration Dashboard, granting Global Administrator access. Root cause is an access-control bypass in the i...

PT-2018-6559

Name of the Vulnerable Software and Affected Versions: Kentico versions 9.0 through 9.0.50 Kentico versions 10.0 through 10.0.47 Description: The issue allows remote attackers to obtain Global Administrator access. This can be achieved by visiting the "CMSInstall/install.aspx" endpoint and then...

Kentico SQL Injection Vulnerability

Kentico is the United States Kentico Software Corporation of a set of ASP.NET-based content management system CMS. The system consists of two main tools : Kentico CMS Desk is used to edit the content of the page ; Kentico CMS Controls is used to edit and control various elements of the page . An...

Kentico Cross-Site Scripting Vulnerability

Kentico is the United States Kentico Software Corporation of a set of ASP.NET-based content management system CMS. The system consists of two main tools : Kentico CMS Desk is used to edit the content of the page ; Kentico CMS Controls is used to edit and control various elements of the page . A...

CVE-2018-6843

Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface...

CVE-2018-6842

Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page...

CVE-2018-6843

Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface...

Sql injection

Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface...

Input validation

Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page...

CVE-2018-6842

Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page...

CVE-2018-6843

CVE-2018-6843 affects Kentico CMS: versions prior to 10.0.50 and prior to 11.0.3 expose an SQL injection in the administration interface due to unsafe construction/validation of user input. The vulnerability can allow manipulation or disclosure of data via the back-end database when accessed thro...

CVE-2018-6843

Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface...

CVE-2018-6842

Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page...

CVE-2018-6842

Kentico CMS is affected by CVE-2018-6842: XSS due to improper construction/validation when crafting a URL. Affected versions are Kentico 10.x before 10.0.50 and 11.x before 11.0.3. Impact is client-side script execution in authenticated/selected contexts via crafted URLs. Remediation per document...

PT-2018-17770

Name of the Vulnerable Software and Affected Versions Kentico versions prior to 10.0.50 Kentico versions 11.0.0 through 11.0.2 Description The issue allows for cross-site scripting XSS due to improper construction of a system page when a crafted URL is used. Recommendations For Kentico versions...

PT-2018-17771

Name of the Vulnerable Software and Affected Versions Kentico versions prior to 10.0.50 Kentico versions prior to 11.0.3 Description The administration interface of Kentico has SQL injection. Recommendations For Kentico versions prior to 10.0.50, update to version 10.0.50 or later. For Kentico...

Kentico CMS Arbitrary Code Execution Vulnerability

Kentico CMS is an enterprise-grade web content management system and customer experience management system. An arbitrary code execution vulnerability exists in Kentico CMS versions 9 through 11, which can be exploited by an authenticated, remote attacker to edit and update ascx code...

Kentico CMS Cross-Site Scripting Vulnerability

Kentico CMS is an enterprise-grade web content management system and customer experience management system. A cross-site scripting vulnerability exists in Kentico CMS versions 9 through 11, which can be exploited by an attacker to inject arbitrary web script or HTML...

CVE-2018-7205

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts - Create devic...

CVE-2018-7046

Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C code in a "Pages - Edit - Template - Edit template properties - Layout" box. NOTE: the vendor has respond...