CVE-2021-47711 HIGH

CVE-2021-47711: Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection

Vendor Kentico
Product Xperience
Weakness CWE-89 · SQLi
Published December 18, 2025
Last update December 18, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.

Key dates

02Disclosure timeline

December 18, 2025 CVE published
December 18, 2025 Record updated