CVE-2025-22390

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate...

CVE-2025-22386

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable...

CVE-2025-22387

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...

CVE-2025-22383

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific...

CVE-2025-22387

Optimizely Configured Commerce versions prior to 5.2.2408 are vulnerable to a medium-severity issue where session tokens are submitted as URL parameters during requests for resources. This insecure practice exposes authenticated session information, which can be leveraged by an attacker to perfor...

CVE-2025-22389

A medium-severity vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.32.0 due to insufficient validation of uploaded files. This flaw allows the upload of potentially malicious file types, such as .docm and .html . If accessed by application users, these files can be lever...

CVE-2025-22388

A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.22.0 . The flaw allows malicious actors to inject and execute arbitrary JavaScript code across multiple functional areas, including content editing , link management , and ...

CVE-2025-22390

A medium-severity vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.32.0 due to insufficient enforcement of password complexity requirements . The application allows users to set passwords with a minimum length of only 6 characters, which lacks the necessary complexity to...

CVE-2025-22386

An issue exists in Optimizely Configured Commerce prior to version 5.2.2408 within the Commerce B2B application. The vulnerability stems from a session management flaw where session tokens associated with logged-out sessions remain active and usable in the storefront. This affects the longevity o...

CVE-2025-22385

The Optimizely Configured Commerce platform is vulnerable in versions prior to 5.2.2408 due to a flaw in the Commerce B2B application . The application fails to require email confirmation for newly created accounts, which allows for the mass creation of accounts . This vulnerability could lead to...

CVE-2025-22383

Optimizely Configured Commerce versions prior to 5.2.2408 are affected by a medium-severity input validation issue within the Commerce B2B application. Specifically, the Contact Us functionality allows visitors to submit email messages containing unfiltered HTML markup under certain conditions. T...

PT-2025-4480 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific...

PT-2025-4481 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: An issue was discovered in Optimizely Configured Commerce where the Commerce B2B application does not require email confirmation for newly created accounts. This allows th...

PT-2025-4479 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that...

CVE-2025-22383: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific...

CVE-2025-22386: Insufficient Session Expiration

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable...

CVE-2025-22384: External Control of Assumed-Immutable Web Parameter

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching...

Optimizely Configured Commerce 安全漏洞

Optimizely Configured Commerce is a combined commerce platform from Optimizely, Inc. A security vulnerability exists in Optimizely Configured Commerce versions prior to 5.2.2408, which stems from the ability to disclose information about authenticated sessions...

PT-2025-4483 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session,...

Optimizely EPiServer.CMS.Core 安全漏洞

Optimizely EPiServer.CMS.Core is a content management system core from Optimizely, Inc. A security vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.32.0 that stems from insufficient complexity of the required password...