Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HKentico Xperience
APPKentico9.0 – 9.0.51 (bez)10.0 – 10.0.48 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
Related vulnerabilities
CVE-2025-2747CRITICAL9.8⚠ KEVPL ✓ten sam produkt
Kentico Xperience — Authentication Bypass w komponencie Staging Sync Server
CVE-2025-2746CRITICAL9.8⚠ KEVPL ✓ten sam produkt
Kentico Xperience – pominięcie uwierzytelnienia w Staging Sync Server
CVE-2019-10068CRITICAL9.8⚠ KEVten sam produkt
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9....
CVE-2019-12102CRITICAL9.1ten sam produkt
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medial...
CVE-2025-2749HIGH7.2⚠ KEVten sam produkt
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to ...