SI
Product
Sitefinity
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 6Medium 13Low 0
Watch
Add Sitefinity to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7201 | 8.8 | Jun 2 | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity Affected: 15.2.8400 before 15.2.8441; 15.3.8500 before 15.3.8531; 15.4.8600 before 15.4.8630 |
| CVE-2017-18179 | 8.8 | Feb 12 | Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination Affected: 9.1 |
| CVE-2026-7195 | 8.1 | Jun 2 | CWE-20: Improper Input Validation in web services in Progress Sitefinity Affected: 14.1.7800 before 14.4.8152; 15.0.8200 before 15.0.8234; 15.1.8300 before 15.1.8335; 15.2.8400 before 15.2.8441; 15.3.8500 before 15.3.8531; 15.4.8600 before 15.4.8630 |
| CVE-2024-11627 | 8.1 | Jan 7 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through… Affected: 4.0 through 14.4.8142; 15.0.8200 through 15.0.8229; 15.1.8300 through 15.1.8327; 15.2.8400 through 15.2.8421 |
| CVE-2026-7312 | 7.5 | Jun 2 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity Affected: 14.0.7700 before 14.4.8152; 15.0.8200 before 15.0.8234; 15.1.8300 before 15.1.8335; 15.2.8400 before 15.2.8441; 15.3.8500 before 15.3.8531; 15.4.8600 before 15.4.8630 |
| CVE-2018-17055 | 7.5 | Sep 28 | An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads Affected: 4.0 through 11.0 |
Showing 6