Kentico Cms
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Kentico Cms.
By the Year
In 2026 there have been 0 vulnerabilities in Kentico Cms. Last year, in 2025 Kentico Cms had 1 security vulnerability published. Right now, Kentico Cms is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 2.40 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 6.10 |
| 2021 | 1 | 9.80 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 8.80 |
| 2018 | 5 | 7.80 |
It may take a day or so for new Kentico Cms vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Kentico Cms Security Vulnerabilities
Kentico CMS XSS via Additional DB Install Wizard (pre-13.0.179)
CVE-2025-2878
2.4 - Low
- March 27, 2025
A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database leads to cross site scripting. The attack can be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affected component.
XSS
Kentico Xperience 13.0.44
CVE-2021-46163
6.1 - Medium
- January 10, 2022
Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem.
XSS
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996
CVE-2021-27581
9.8 - Critical
- March 05, 2021
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
SQL Injection
Kentico CMS before 11.0.45
CVE-2018-19453
8.8 - High
- April 10, 2019
Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.
Unrestricted File Upload
Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in
CVE-2018-6842
- March 19, 2018
Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
CVE-2018-6843
- March 19, 2018
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
Arbitrary code execution vulnerability in Kentico 9 through 11
CVE-2018-7046
- February 20, 2018
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link
CVE-2018-7205
- February 20, 2018
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
Kentico 9.0 through 11.0 has a stack-based buffer overflow
CVE-2018-5282
7.8 - High
- January 08, 2018
Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. NOTE: the vendor disputes this issue because neither a buffer overflow nor a crash can be reproduced; also, reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework
Memory Corruption
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Kentico Cms or by Kentico? Click the Watch button to subscribe.
