PT-2025-52306 · Kentico · Kentico Xperience

Liam Goldfinch · Published 2025-12-18 · Updated 2025-12-24 · CVE-2022-50684

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kentico Xperience (affected versions not specified)

Description A flaw exists in Kentico Xperience that permits the injection of malicious HTML into form submission emails. This occurs because form fields are not properly encoded, allowing attackers to insert HTML content that can be executed within the recipient's email client. This could lead to compromised email security. The vulnerability involves unencoded form values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-50684

Affected Products

Kentico Xperience

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-50684 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50684 · Vendor Advisory
• https://devnet.kentico.com/download/hotfixes · Patch, Vendor Advisory
• https://t.me/cveNotify/146787 · Telegram Post
• https://twitter.com/CVEnew/status/2002117795828347312 · Twitter Post
• https://vulncheck.com/advisories/kentico-xperience-form-emails-html-injection · Note