---
title: Security advisory 2026-06-04
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## SQL Injection in Form Builder

**CVSS**: 8.7\
**Affected versions**: 22.0.0 - 31.5.2\
**Category**: SQL injection

### Summary

Xperience by Kentico was affected by an SQL injection vulnerability in [Form Builder](https://docs.kentico.com/documentation/developers-and-admins/development/builders/form-builder.md). Due to missing back-end validation, an attacker could tamper with form field names, which were then processed and incorporated into database queries. Exploitation required authenticated access to the administration interface with permissions for editing forms. An authenticated attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to application compromise.

### How to fix

Update to the latest version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.

### Acknowledgments

This issue was reported by Ethan Pike.