Back to Database
Status published
Medium
CVE-2025-32369
Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious...
Vulnerability Description
Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32369
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Piotr Bazydlo (@chudyPB) of watchTowr
References
More from Kentico
View All →CVE-2025-5591
Stored Cross-site Scripting (XSS) in Kentico Xperience 13
High
7.7
CVE-2025-32370
Kentico Xperience before 13.0.178 has a specific set of allowed...
High
7.2
CVE-2025-2878
Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting
Medium
4.8
CVE-2025-2794
Kentico Xperience <= 13.0.180 Unsafe Reflection
High
8.7
CVE-2025-2749
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
High
7.2
Affected Vendor
Kentico
View all reports →Affected Software
Xperience
Vulnerable Versions:
0
Timeline
Official Publish:
April 6th, 2025
Last Modified:
April 7th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N