Kentico Xperience

Kentico Xperience <= 13.0.158 Shipping Options Stored XSS

Kentico Xperience <= 13.0.159 Form Validation Stored XSS

Kentico Xperience <= 13.0.74 Form Configuration Stored XSS

Kentico Xperience <= 13.0.56 File Upload Stored XSS

Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure

Kentico Xperience <= 12.0.0 User Widget Information Disclosure

Kentico Xperience <= 13.0.92 Email Marketing Stored XSS

Kentico Xperience <= 13.0.101 Localization Application Stored XSS

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout