Sitefinity (Progress) - vulnerabilities (CVEs)

24 CVEs, 0 in the last 30 days, 461 known versions, newest CVE from 2026-06-02. Vendor: Progress.

CVEs of Sitefinity

CVE-2026-7195 - CVSS 8.8 (high), 2026-06-02: CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x…
CVE-2026-7312 - CVSS 10 (critical), 2026-06-02: CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and…
CVE-2026-7201 - CVSS 8.8 (high), 2026-06-02: CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x…
CVE-2026-7198 - CVSS 9.8 (critical), 2026-06-02: CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content…
CVE-2026-7313 - CVSS 8.7 (high), 2026-06-02: CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker…
CVE-2024-11626 - CVSS 8.4 (high), 2025-01-07: Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress…
CVE-2024-11625 - CVSS 7.7 (high), 2025-01-07: Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through…
CVE-2024-11627 - CVSS 8.1 (high), 2025-01-07: : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142,…
CVE-2023-27636 - CVSS 6.5 (medium), 2024-06-16: Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
CVE-2024-1636 - CVSS 8 (high), 2024-02-28: Potential Cross-Site Scripting (XSS) in the page editing area.
CVE-2024-1632 - CVSS 8.8 (high), 2024-02-28: Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
CVE-2023-6784 - CVSS 4.7 (medium), 2023-12-20: A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.
CVE-2023-29376 - CVSS 5.4 (medium), 2023-04-10: An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before…
CVE-2023-29375 - CVSS 9.8 (critical), 2023-04-10: An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before…
CVE-2019-17392 - CVSS 9.8 (critical), 2019-11-26: Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.
CVE-2019-7215 - CVSS 6.5 (medium), 2019-06-06: Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid…
CVE-2018-17055 - CVSS 7.5 (high), 2018-09-28: An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.
CVE-2017-18175 - CVSS 5.4 (medium), 2018-02-12: Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG…
CVE-2017-18178 - CVSS 6.1 (medium), 2018-02-12: Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is…
CVE-2017-18177 - CVSS 5.4 (medium), 2018-02-12: Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1.
CVE-2017-18176 - CVSS 5.4 (medium), 2018-02-12: Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in…
CVE-2017-18179 - CVSS 8.8 (high), 2018-02-12: Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination.…
CVE-2017-15883 - CVSS 9.8 (critical), 2018-01-08: Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load…
CVE-2017-9248 - CVSS 9.8 (critical), 2017-07-03: Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect…