CVE-2024-1636

CVE-2024-1636 is a reported Cross-Site Scripting (XSS) issue described as affecting the page editing area in Sitefinity CMS (Progress). The Red Hat entry reiterates the same CVE and frames it in terms of low-privilege user access potentially impacting the Sitefinity backend. Public documents do n...

CVE-2024-1632

CVE-2024-1632 is a vulnerability in Progress Sitefinity CMS where low-privileged users with backend access can obtain sensitive information from the administrative area. The connected sources confirm the issue affects the Sitefinity backend and constitutes an information disclosure (confidentiali...

CVE-2024-11626

Progress Sitefinity CVE-2024-11626 is an XSS-type vulnerability due to improper input neutralization in the CMS backend page generation. It affects Sitefinity releases 4.0–14.4.8142, 15.0.8200–15.0.8229, 15.1.8300–15.1.8327, and 15.2.8400–15.2.8421. The CVE details are corroborated by NVD, Red Ha...

CVE-2024-11627

Summary: CVE-2024-11627 is an insufficient session expiration vulnerability in Progress Sitefinity that enables session fixation. Affected software: Progress Sitefinity across multiple versions (4.0–14.4.8142; 15.0.8200–15.0.8229; 15.1.8300–15.1.8327; 15.2.8400–15.2.8421). Vulnerability type: ses...

CVE-2017-18179

Progress Sitefinity 9.1 contains a vulnerability where wrap_access_token is a non‑expiring authentication token that remains valid after a password change or session termination and is transmitted as a GET parameter. This could enable token exposure and unauthorized access. The issue is fixed in ...

CVE-2026-7313

CVE-2026-7313 affects Progress Sitefinity Web Services (versions 8.0.5700–13.3.7652). It describes CWE-522: Insufficiently Protected Credentials in web services, allowing a remote authenticated attacker to obtain plaintext credentials used to connect to the Sitefinity Insight service. Exploitatio...

CVE-2026-7195

CVE-2026-7195 affects Progress Sitefinity web services. The issue is CWE-20: Improper Input Validation in Sitefinity versions 14.1.x–14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630. A ...

CVE-2026-7201

Progress Sitefinity (Progress) is affected by CVE-2026-7201: CWE-639, an authorization bypass through a user-controlled key in web services. A remote authenticated attacker can modify account properties of other users, potentially leading to account compromise, requiring access to values not norm...