Kentico Cms
Approved changes feed: RSS · Atom
cpe:2.3:a:kentico:kentico_cms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kentico (f19b4bb1-ef96-5d93-959f-2df9c0fe8b14) |
|---|---|
| Product | Kentico Cms (7b0bba9c-ba02-5c23-ac4a-719473b35132) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-12907 |
vulnerable | 2026-06-08 06:25:36.313130 |
XSS in Kentico 7
Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint.
Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this vulnerability.
Published: 2025-01-02T15:59:13.377Z
Updated: 2025-01-02T17:35:45.661Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7205 |
vulnerable | 2026-06-08 05:11:55.165713 |
Details available
Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
Published: 2018-02-20T15:00:00.000Z
Updated: 2024-08-05T06:24:11.480Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7046 |
vulnerable | 2026-06-08 05:11:54.740523 |
Details available
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
Published: 2018-02-20T15:00:00.000Z
Updated: 2024-08-05T06:17:17.427Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-6843 |
vulnerable | 2026-06-08 05:11:54.295006 |
Details available
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
Published: 2018-03-19T14:00:00.000Z
Updated: 2024-08-05T06:17:15.848Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-6842 |
vulnerable | 2026-06-08 05:11:54.294507 |
Details available
Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.
Published: 2018-03-19T14:00:00.000Z
Updated: 2024-08-05T06:17:15.831Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-5282 |
vulnerable | 2026-06-08 05:11:50.565409 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19453 |
vulnerable | 2026-06-08 05:11:15.760735 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-17736 |
vulnerable | 2026-06-08 05:09:09.807613 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.