PT-2025-52300 · Kentico · Kentico Xperience

Published 2025-12-18 · Updated 2025-12-19 · CVE-2021-47711

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kentico Xperience (affected versions not specified)

Description A SQL injection issue exists in Kentico Xperience, potentially allowing authenticated editors to inject malicious SQL queries through online marketing macro method parameters. This is due to weaknesses in input validation for macro method inputs. Successful exploitation could lead to unauthorized database access and data manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47711

Affected Products

Kentico Xperience

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-47711 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47711 · Vendor Advisory
• https://devnet.kentico.com/download/hotfixes · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/2002117801331347563 · Twitter Post
• https://vulncheck.com/advisories/kentico-xperience-online-marketing-macros-sql-injection · Note
• https://twitter.com/CveFindCom/status/2001754308035899539 · Twitter Post