CVE-2023-53934

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through maliciously constructed requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-97

Affected software

VendorProductVersions
KenticoXperience<= 12.0.98

References

Timeline

Published
Dec 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-539355.4WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter iCVE-2023-539364.8Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scrCVE-2023-539377.8Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dCVE-2023-539385.4RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unenCVE-2023-539395.4TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts thrCVE-2023-53947.4Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in posCVE-2023-539407.8Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a maCVE-2023-539419.8EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commCVE-2023-539428.8File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to CVE-2023-539435.3GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addCVE-2023-539446.5EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the docuCVE-2023-539458.8BrainyCP 1.0 contains an authenticated remote code execution vulnerability that allows logged-in users to inject arbitrary commands through
CVE-2023-53934: High severity, CVSS 7.5 | Vulnix