SI
Product
Sitefinity
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 6Medium 13Low 0
Watch
Add Sitefinity to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-1632 | 6.5 | Feb 28 | Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area Affected: before 13.3.7649; 14.0 before 14.4.8135; 15.0.8200 before 15.0.8227 |
| CVE-2019-7215 | 6.5 | Jun 6 | Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts Affected: 7.0 before 7.0.5143; 7.1 before 7.1.5243; 7.2 before 7.2.5353; 7.3 before 7.3.5693; 8.0 before 8.0.5773; 8.1 before 8.1.5863; +10 more |
| CVE-2017-18178 | 6.1 | Feb 12 | Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is specified using a… Affected: 9.1 |
| CVE-2023-27636 | 5.4 | Jun 16 | Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor Affected: before 15.0.0 |
| CVE-2024-1636 | 5.4 | Feb 28 | Potential Cross-Site Scripting (XSS) in the page editing area Affected: before 13.3.7649; 14.0 before 14.4.8135; 15.0.8200 before 15.0.8227 |
| CVE-2023-29376 | 5.4 | Apr 10 | An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025 Affected: 13.3 before 13.3.7646; 14.0 before 14.0.7736; 14.1 before 14.1.7826; 14.2 before 14.2.7930; 14.3 before 14.3.8026 |
| CVE-2017-18177 | 5.4 | Feb 12 | Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page Affected: 9.1 |
| CVE-2017-18176 | 5.4 | Feb 12 | Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code Affected: 9.1 |
| CVE-2017-18175 | 5.4 | Feb 12 | Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element Affected: 9.1 |
| CVE-2024-11625 | 5.3 | Jan 7 | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200… Affected: 4.0 before 14.4.8143; 15.0.8200 before 15.0.8230; 15.1.8300 before 15.1.8328; 15.2.8400 before 15.2.8422 |
| CVE-2026-7313 | 4.9 | Jun 2 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity Affected: 8.0.5700 before 13.3.7652 |
| CVE-2024-11626 | 4.8 | Jan 7 | Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue… Affected: 4.0 before 14.4.8143; 15.0.8200 before 15.0.8230; 15.1.8300 before 15.1.8328; 15.2.8400 before 15.2.8422 |
| CVE-2023-6784 | 4.3 | Dec 20 | A malicious user could potentially use the Sitefinity system for the distribution of phishing emails Affected: 4.0 before 13.3.7648; 14.1 before 14.1.7828; 14.2 before 14.2.7932; 14.3 before 14.3.8029; 14.4 before 14.4.8133; 15.0 before 15.0.8223 |
Showing 13