What’s Vulnerable › Vulnerabilities

CVE-2019-25228: Kentico Xperience <= 12.0.47 Virtual Context Information Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-18 · updated 2026-06-17
• Weakness: CWE-497

Description

An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and link/image loading.

Affected products

• Kentico Xperience: through 12.0.47

References

• https://devnet.kentico.com/download/hotfixes
• https://www.vulncheck.com/advisories/kentico-xperience-virtual-context-information-disclosure

Get alerted when CVE-2019-25228 or the next vulnerability affects your stack