CVE-2024-58321

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers can exploit this vulnerability to execute malicious scripts that will run in users' browsers.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Kentico	Xperience	<= 13.0.159

References

https://devnet.kentico.com/download/hotfixesProduct
https://www.vulncheck.com/advisories/kentico-xperience-form-validation-stored-xssThird Party Advisory

Timeline

Published: Dec 18, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-583225.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configurati CVE-2024-583235.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form componen CVE-2024-58338.8Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access vi CVE-2024-583307.5A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytic CVE-2024-583355.0OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualiz CVE-2024-583365.3Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting CVE-2024-583374.3Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access s CVE-2024-5833810.0Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through CVE-2024-583397.5LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the Van CVE-2024-58348.8Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a craft CVE-2024-583407.5LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.pa CVE-2024-583418.2OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecti