PT-2026-1201 · Kentico · Kentico Xperience 13

Michael Nervo · Publicado 2026-01-05 · Atualizado 2026-01-22 · CVE-2025-5591

Positive Technologies (AI Summary)

CVSS v4.0

7.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U

Name of the Vulnerable Software and Affected Versions Kentico Xperience version 13

Description Kentico Xperience 13 is susceptible to a stored cross-site scripting (XSS) attack through a form component. This allows an attacker to hijack a victim user’s session and perform actions with the victim’s permissions. The vulnerability specifically resides in the Checkbox form component of Form Builder. Successful exploitation involves injecting malicious scripts that execute in the victim’s browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-1188

CWE-79

Identificadores relacionados

CVE-2025-5591

Produtos afetados

Kentico Xperience 13

Referências · 9

• https://themissinglink.com.au/security-advisories/cve-2025-5591 · Nota
• https://twitter.com/transilienceai/status/2008018329139663309 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-5591 · Aviso do Fabricante
• https://t.me/cveNotify/147662 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2008017769791393942 · Publicação no Twitter
• https://twitter.com/UndercodeUpdate/status/2009831458735829049 · Publicação no Twitter
• https://t.me/cveNotify/149584 · Publicação no Telegram
• https://t.me/CVEtracker/41338 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-5591 · Nota de Segurança