PT-2025-13408 · Kentico · Kentico Cms

C4Ng4C3Ir0 · Published 2025-03-27 · Updated 2025-03-29 · CVE-2025-2878

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Kentico CMS versions up to 13.0.178

Description A vulnerability was found in the Additional Database Installation Wizard component of Kentico CMS, specifically in the file /CMSInstall/install.aspx. The issue is related to the manipulation of the new database argument, which leads to cross-site scripting. This can be exploited remotely.

Recommendations For versions up to 13.0.178, upgrade to version 13.0.179 to address this issue. It is recommended to upgrade the affected Additional Database Installation Wizard component.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-2878

Affected Products

Kentico Cms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-2878 · Security Note
• https://devnet.kentico.com/download/hotfixes · Patch
• https://vuldb.com/?id.301813 · Note
• https://twitter.com/CVEnew/status/1905811742879305760 · Twitter Post
• https://t.me/cvenotify/116643 · Telegram Post
• https://t.me/cvedetector/21342 · Telegram Post
• https://vuldb.com/?ctiid.301813 · Note
• https://t.me/cvetracker/20116 · Telegram Post
• https://vuldb.com/?submit.503058 · Note