SI
Product
Sitefinity
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 6Medium 13Low 0
Watch
Add Sitefinity to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-9248 In wildKEV | 9.8 | Jul 3 | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability Affected: before 10.0.6412.0 |
| CVE-2026-7198 | 9.8 | Jun 2 | CWE-284: Improper Access Control in web services in Progress Sitefinity Affected: 15.4.8623 before 15.4.8630 |
| CVE-2023-29375 | 9.8 | Apr 10 | An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025 Affected: 13.3 before 13.3.7646; 14.0 before 14.0.7736; 14.1 before 14.1.7826; 14.2 before 14.2.7930; 14.3 before 14.3.8026 |
| CVE-2019-17392 | 9.8 | Nov 26 | Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled Affected: 9.1 before 9.1.6185; 9.2 before 9.2.6276; 10.0 before 10.0.6431; 10.1 before 10.1.6542; 10.2 through 10.2.6651; 11.0 through 11.0.6739; +4 more |
| CVE-2017-15883 | 9.8 | Jan 8 | Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or… Affected: 5.1; 5.2; 5.3; 5.4; 6.0; 6.1; +14 more |
| CVE-2026-7201 | 8.8 | Jun 2 | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity Affected: 15.2.8400 before 15.2.8441; 15.3.8500 before 15.3.8531; 15.4.8600 before 15.4.8630 |
| CVE-2017-18179 | 8.8 | Feb 12 | Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination Affected: 9.1 |
| CVE-2026-7195 | 8.1 | Jun 2 | CWE-20: Improper Input Validation in web services in Progress Sitefinity Affected: 14.1.7800 before 14.4.8152; 15.0.8200 before 15.0.8234; 15.1.8300 before 15.1.8335; 15.2.8400 before 15.2.8441; 15.3.8500 before 15.3.8531; 15.4.8600 before 15.4.8630 |
| CVE-2024-11627 | 8.1 | Jan 7 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through… Affected: 4.0 through 14.4.8142; 15.0.8200 through 15.0.8229; 15.1.8300 through 15.1.8327; 15.2.8400 through 15.2.8421 |
| CVE-2026-7312 | 7.5 | Jun 2 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity Affected: 14.0.7700 before 14.4.8152; 15.0.8200 before 15.0.8234; 15.1.8300 before 15.1.8335; 15.2.8400 before 15.2.8441; 15.3.8500 before 15.3.8531; 15.4.8600 before 15.4.8630 |
| CVE-2018-17055 | 7.5 | Sep 28 | An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads Affected: 4.0 through 11.0 |
| CVE-2024-1632 | 6.5 | Feb 28 | Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area Affected: before 13.3.7649; 14.0 before 14.4.8135; 15.0.8200 before 15.0.8227 |
| CVE-2019-7215 | 6.5 | Jun 6 | Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts Affected: 7.0 before 7.0.5143; 7.1 before 7.1.5243; 7.2 before 7.2.5353; 7.3 before 7.3.5693; 8.0 before 8.0.5773; 8.1 before 8.1.5863; +10 more |
| CVE-2017-18178 | 6.1 | Feb 12 | Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is specified using a… Affected: 9.1 |
| CVE-2023-27636 | 5.4 | Jun 16 | Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor Affected: before 15.0.0 |
| CVE-2024-1636 | 5.4 | Feb 28 | Potential Cross-Site Scripting (XSS) in the page editing area Affected: before 13.3.7649; 14.0 before 14.4.8135; 15.0.8200 before 15.0.8227 |
| CVE-2023-29376 | 5.4 | Apr 10 | An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025 Affected: 13.3 before 13.3.7646; 14.0 before 14.0.7736; 14.1 before 14.1.7826; 14.2 before 14.2.7930; 14.3 before 14.3.8026 |
| CVE-2017-18177 | 5.4 | Feb 12 | Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page Affected: 9.1 |
| CVE-2017-18176 | 5.4 | Feb 12 | Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code Affected: 9.1 |
| CVE-2017-18175 | 5.4 | Feb 12 | Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element Affected: 9.1 |
| CVE-2024-11625 | 5.3 | Jan 7 | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200… Affected: 4.0 before 14.4.8143; 15.0.8200 before 15.0.8230; 15.1.8300 before 15.1.8328; 15.2.8400 before 15.2.8422 |
| CVE-2026-7313 | 4.9 | Jun 2 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity Affected: 8.0.5700 before 13.3.7652 |
| CVE-2024-11626 | 4.8 | Jan 7 | Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue… Affected: 4.0 before 14.4.8143; 15.0.8200 before 15.0.8230; 15.1.8300 before 15.1.8328; 15.2.8400 before 15.2.8422 |
| CVE-2023-6784 | 4.3 | Dec 20 | A malicious user could potentially use the Sitefinity system for the distribution of phishing emails Affected: 4.0 before 13.3.7648; 14.1 before 14.1.7828; 14.2 before 14.2.7932; 14.3 before 14.3.8029; 14.4 before 14.4.8133; 15.0 before 15.0.8223 |
Showing 24