VDB
CISA-2025-2747
CISA-2025-2747
PUBLISHED
CVSS 9.8 CRITICAL
Reported by VulnCheck · Published March 24, 2025
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Risk Scores
CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kentico | Xperience | 0 |
| kentico | xperience | 0, 0 |
| Kentico | Xperience | 0, 0 |
Timeline
- Mar 24, 2025 CVE Published
- Feb 26, 2026 CVE Updated
References
- technical-descriptionexploit
- vendor-advisorypatch
- exploit
- third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2747 url