CVE-2025-22389

A medium-severity vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.32.0 due to insufficient validation of uploaded files. This flaw allows the upload of potentially malicious file types, such as .docm and .html . If accessed by application users, these files can be lever...

CVE-2025-22390

A medium-severity vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.32.0 due to insufficient enforcement of password complexity requirements . The application allows users to set passwords with a minimum length of only 6 characters, which lacks the necessary complexity to...

CVE-2025-22388

A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.22.0 . The flaw allows malicious actors to inject and execute arbitrary JavaScript code across multiple functional areas, including content editing , link management , and ...

CVE-2023-31754

Optimizely CMS UI before v12.16.0 is affected by a cross-site scripting (XSS) vulnerability in the Admin panel. The root cause is an XSS issue in the Admin interface, leading to potential script injection. Affected software: Optimizely CMS UI prior to 12.16.0. Impact is described as XSS; specific...