Actively exploited vulnerabilities affecting Kentico products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-2749https://wildfortech.com/security#CVE-2025-2749This vulnerability in Kentico Xperience allows an authenticated user to abuse the Staging Sync Server feature to write arbitrary data outside of intended directories via path traversal. In practice, this means an attacker with valid credentials could plant malicious files — such as web shells — in sensitive locations on the server, potentially leading to full system compromise. Because authentication is required, the immediate risk is somewhat contained, but insider threats or compromised accounts make this serious.Mon, 20 Apr 2026 00:00:00 GMTKenticoKentico Xperiencehttps://wildfortech.com/security#CVE-2025-2746https://wildfortech.com/security#CVE-2025-2746This vulnerability in Kentico Xperience CMS allows an attacker to bypass authentication by using an alternate path or channel, potentially giving them unauthorized control over administrative objects within the CMS. For organizations running this platform, that means an unauthenticated attacker could manipulate content, configurations, or user data at an administrative level — without needing valid credentials. The risk is significant for any internet-facing Kentico deployment.Mon, 20 Oct 2025 00:00:00 GMTKenticoXperience CMShttps://wildfortech.com/security#CVE-2025-2747https://wildfortech.com/security#CVE-2025-2747This vulnerability in Kentico Xperience CMS allows an attacker to bypass authentication through an alternate path or channel, meaning they could gain unauthorized control over administrative objects without valid credentials. For organizations running this CMS, a successful exploit could let an attacker manipulate site content, configurations, or user data at an administrative level — a significant risk for any internet-facing deployment.Mon, 20 Oct 2025 00:00:00 GMTKenticoXperience CMS