CVE-2022-50685

MediumCVSS 5.4/10Last modified Nov 10, 2026

Description

A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachments or metafiles. Attackers can upload malicious XML files that enable stored XSS, allowing malicious scripts to execute in users' browsers.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Kentico	Xperience	<= 13.0.56

References

https://devnet.kentico.com/download/hotfixesProduct
https://www.vulncheck.com/advisories/kentico-xperience-file-upload-stored-xss2Third Party Advisory

Timeline

Published: Dec 18, 2025
Last modified: Nov 10, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-506867.5An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form c CVE-2022-506875.5Cobian Backup 11 Gravity 11.2.0.582 contains a denial of service vulnerability in the FTP password input field that allows attackers to cras CVE-2022-506888.4Cobian Backup Gravity 11.2.0.582 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary co CVE-2022-506895.5Cobian Reflector 0.9.93 RC1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the pas CVE-2022-506908.4Wondershare MirrorGo 2.0.11.346 contains a local privilege escalation vulnerability due to incorrect file permissions on executable files. U CVE-2022-506919.8MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as ro CVE-2022-506927.5SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse CVE-2022-506938.4Splashtop 8.71.12001.0 contains an unquoted service path vulnerability in the Splashtop Software Updater Service that allows local attackers CVE-2022-506949.8SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attack CVE-2022-506957.5SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to ar CVE-2022-506969.8SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified throu CVE-2022-506977.8In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The c