Skip to main content

Xperience CVE-2025-2746

CRITICAL
Authentication Bypass Using an Alternate Path or Channel (CWE-288)
2025-03-24 disclosure@vulncheck.com
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Mar 28, 2026 - 18:33 vuln.today
Patch released
Mar 28, 2026 - 18:33 nvd
Patch available
Added to CISA KEV
Nov 06, 2025 - 13:58 cisa
CISA KEV
PoC Detected
Nov 06, 2025 - 13:58 vuln.today
Public exploit code
CVE Published
Mar 24, 2025 - 19:15 nvd
CRITICAL 9.8

DescriptionCVE.org

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

AnalysisAI

Kentico Xperience through 13.0.172 contains an authentication bypass in the Staging Sync Server through empty SHA1 username handling in digest authentication, allowing administrative object control.

Technical ContextAI

The CWE-288 authentication bypass exploits the digest authentication implementation where an empty SHA1 hash for the username field matches a specific validation condition, allowing the attacker to authenticate without valid credentials.

RemediationAI

Update to Kentico Xperience 13.0.173+. Restrict access to the Staging Sync Server endpoint. Audit for unauthorized staging operations.

CVE-2025-2747 CRITICAL POC
9.8 Mar 24

Kentico Xperience contains a second authentication bypass in the Staging Sync Server through None-type password handling

CVE-2019-10068 CRITICAL POC
9.8 Mar 26

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions

CVE-2018-5282 HIGH POC
7.8 Jan 08

Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password fie

CVE-2019-6242 HIGH POC
7.2 Feb 08

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuratio

CVE-2018-7046 HIGH POC
7.2 Feb 20

Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary op

CVE-2025-32369 MEDIUM POC
6.4 Apr 06

Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certai

CVE-2025-2748 MEDIUM POC
6.1 Mar 24

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload function

CVE-2021-43991 MEDIUM POC
5.4 Dec 03

The Kentico Xperience CMS version 13.0 - 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability

CVE-2019-19493 MEDIUM POC
5.4 Dec 02

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea

CVE-2019-12102 CRITICAL
9.1 May 22

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/for

CVE-2025-2794 HIGH
8.7 Mar 31

An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process,

CVE-2022-29287 MEDIUM POC
4.9 Apr 16

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. Rated medium severity (CVSS 4.9), this

Share

CVE-2025-2746 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy