---
title: Security advisory 2025-03-27
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## SQL Injection in kentico-xperience-dbmanager tool

**CVSS**: 6.4\
**Affected versions**: 30.3.0 and lower\
**Category**: SQL injection

### Summary

The `kentico-xperience-dbmanager` tool used during the [Xperience installation process](https://docs.kentico.com/documentation/developers-and-admins/installation.md) to install and maintain project databases was vulnerable to SQL injection in the `--database-name` (`-d`) parameter. The issue was fixed by correctly sanitizing the user-provided name.

### How to fix

Update to the latest version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.