CVE-2019-25228

An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and link/image loading.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - disclosure@vulncheck.com

Published

2025-12-18

Last modified

2025-12-27

Weaknesses

CWE-497

Affected products

• Xperience (Kentico)

References

• https://devnet.kentico.com/download/hotfixes
• https://www.vulncheck.com/advisories/kentico-xperience-virtual-context-information-disclosure