CVE-2021-47711 | THREATINT

Description

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.

PUBLISHED Reserved 2025-12-05 | Published 2025-12-18 | Updated 2025-12-18 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Any version

affected

Credits

Kentico Security Team finder

References

devnet.kentico.com/download/hotfixes (Kentico DevNet Hotfixes) vendor-advisory patch

www.vulncheck.com/...e-online-marketing-macros-sql-injection (VulnCheck Advisory: Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection) third-party-advisory

cve.org (CVE-2021-47711)

nvd.nist.gov (CVE-2021-47711)

Download JSON