CVE-2021-47711
HIGHKentico Xperience < 13.0.52 - Authenticated SQL Injection via Online Marketing Macro Method Parameters
Title source: llmDescription
A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.
References (2)
Core 2
Core References
Product vendor-advisory
patch
https://devnet.kentico.com/download/hotfixes
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/kentico-xperience-online-marketing-macros-sql-injection
Scores
CVSS v3
8.8
EPSS
0.0026
EPSS Percentile
17.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
kentico/xperience
< 13.0.52
Published
Dec 18, 2025
Tracked Since
Feb 18, 2026