Kentico Xperience 13 CMS - Staging Service Authentication Bypass

Kentico Staging SyncServer accepts UsernameToken without password WT-2025-0011. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging Service Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Kentico Xperience 13 CMS - Staging None-password Authentication Bypass

Kentico Staging SyncServer None-type password handling auth bypass WT-2025-0006. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging None-password Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Kentico CMS Staging SyncServer Unserialize Remote Command Execution

This module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier. Remote Command Execution is possible via unauthenticated XML requests to the Staging Service SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML input is passe...