{"id":"CVE-2021-47711","state":"PUBLISHED","title":"Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection","description":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.","publishedAt":"2025-12-18T19:53:26.564Z","updatedAt":"2025-12-18T21:48:09.105Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Kentico Xperience"],"affected":[{"vendor":"Kentico","product":"Xperience","versions":[{"version":"0","status":"affected","lessThanOrEqual":"13.0.52","versionType":"custom"}]}],"references":["https://devnet.kentico.com/download/hotfixes","https://www.vulncheck.com/advisories/kentico-xperience-online-marketing-macros-sql-injection"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47711.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47711","state":"PUBLISHED","datePublished":"2025-12-18T19:53:26.564Z","dateUpdated":"2025-12-18T21:48:09.105Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-05T19:10:29.046Z"},"containers":{"cna":{"title":"Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection","descriptions":[{"lang":"en","value":"A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses."}],"affected":[{"vendor":"Kentico","product":"Xperience","versions":[{"version":"0","status":"affected","lessThanOrEqual":"13.0.52","versionType":"custom"}]}],"references":[{"url":"https://devnet.kentico.com/download/hotfixes","name":"Kentico DevNet Hotfixes","tags":["vendor-advisory","patch"]},{"url":"https://www.vulncheck.com/advisories/kentico-xperience-online-marketing-macros-sql-injection","name":"VulnCheck Advisory: Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2025-12-18T19:53:26.564Z"},"datePublic":"2021-11-26T00:00:00.000Z","credits":[{"lang":"en","value":"Kentico Security Team","type":"finder"}],"x_generator":{"engine":"vulncheck"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*","versionEndIncluding":"13.0.52","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-18T21:08:42.561605Z","id":"CVE-2021-47711","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-18T21:48:09.105Z"}}]}}}