CVE-2025-22389

CVE-2025-22389 affects Optimizely EPiServer.CMS.Core (prior to 12.32.0). The root cause is improper validation of uploaded files, allowing potentially malicious file types (e.g., .docm, .html) to be uploaded and accessed by application users, enabling malicious actions or system compromise. Docum...

CVE-2025-22390

Optimizely EPiServer.CMS.Core prior to 12.32.0 contains a password- policy weakness where passwords as short as 6 characters may be set due to insufficient complexity enforcement. This vulnerability could enable offline cracking or password spraying in theory, given weak password requirements. Af...

CVE-2025-22388

Optimizely EPiServer.CMS.Core prior to version 12.22.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the CMS, affecting areas such as content editing, link management, and file uploads. The issue allows an attacker to inject and execute arbitrary JavaScript, which could compromise...

CVE-2023-31754

Optimizely CMS UI before v12.16.0 is affected by a cross-site scripting (XSS) vulnerability in the Admin panel. The root cause is an XSS issue in the Admin interface, leading to potential script injection. Affected software: Optimizely CMS UI prior to 12.16.0. Impact is described as XSS; specific...