CVE-2019-25230 Kentico Xperience <= 12.0.0 User Widget Information Disclosure

What is CVE-2019-25230?

CVE-2019-25230 is a medium-severity vulnerability in Kentico Xperience, published on 18 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget properties dialog. Attackers can exploit this vulnerability to access unauthorized system information without proper access controls.

Weakness: CWE-497

Which versions are affected by CVE-2019-25230?

It affects 1 product.

Products include Kentico Xperience.

How do I fix CVE-2019-25230?

No fix has been published for CVE-2019-25230 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-25230 being exploited?

There is no known exploitation of CVE-2019-25230 in the wild and no public exploit code.

Other vulnerabilities in Kentico Xperience

• CVE-2025-2746 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Exploited Critical 9.8
• CVE-2025-2747 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Exploited Critical 9.8
• CVE-2019-10068 Kentico Xperience Deserialization of Untrusted Data Exploited Critical 9.8
• CVE-2025-2749 Kentico Xperience Path Traversal Exploited High 7.2
• CVE-2017-17736 Missing authorization in n/a Critical 9.8

All Kentico Xperience vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-chj5-cq2p-wvfv.