CVE-2025-22389

A medium-severity vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.32.0 due to insufficient validation of uploaded files. This flaw allows the upload of potentially malicious file types, such as .docm and .html . If accessed by application users, these files can be used ...

CVE-2025-22390

A medium-severity vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.32.0 due to insufficient enforcement of password complexity requirements. The CMS allows users to set passwords with a minimum length of only 6 characters, which lacks the necessary complexity to resist m...

CVE-2025-22388

A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.22.0 . The root cause is the improper neutralization of input during web page generation, allowing attackers to inject and execute arbitrary JavaScript code. This vulnerabi...

CVE-2023-31754

Optimizely CMS UI before v12.16.0 is affected by a cross-site scripting (XSS) vulnerability in the Admin panel. The root cause is an XSS issue in the Admin interface, leading to potential script injection. Affected software: Optimizely CMS UI prior to 12.16.0. Impact is described as XSS; specific...