# Kentico Xperience


- [CVE-2025-2746](https://insights.sbomify.com/CVE-2025-2746/): Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel (critical 9.8, exploited in the wild)
- [CVE-2025-2747](https://insights.sbomify.com/CVE-2025-2747/): Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel (critical 9.8, exploited in the wild)
- [CVE-2019-10068](https://insights.sbomify.com/CVE-2019-10068/): Kentico Xperience Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2025-2749](https://insights.sbomify.com/CVE-2025-2749/): Kentico Xperience Path Traversal (high 7.2, exploited in the wild)
- [CVE-2017-17736](https://insights.sbomify.com/CVE-2017-17736/): Missing authorization in n/a (critical 9.8)
- [CVE-2019-12102](https://insights.sbomify.com/CVE-2019-12102/): Missing authorization in n/a (critical 9.1)
- [CVE-2018-19453](https://insights.sbomify.com/CVE-2018-19453/): File upload in n/a (high 8.8)
- [CVE-2019-25229](https://insights.sbomify.com/CVE-2019-25229/): Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload (high 8.7)
- [CVE-2021-47711](https://insights.sbomify.com/CVE-2021-47711/): Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection (high 8.7)
- [CVE-2023-53934](https://insights.sbomify.com/CVE-2023-53934/): Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service (high 8.7)
- [CVE-2025-2794](https://insights.sbomify.com/CVE-2025-2794/): Kentico Xperience <= 13.0.180 Unsafe Reflection (high 8.7)
- [CVE-2020-36890](https://insights.sbomify.com/CVE-2020-36890/): Kentico Xperience <= 10 Administrator Access Control Bypass (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/products/kentico/xperience/