QSearchQSearch

CVE-2026-7195

8.8 HIGH

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15...

Published: 2026-06-02 · Last updated: 2026-06-04

Severity and scoring

CVSS
8.8 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
CWE-20

Affected products

VendorProduct
progresssitefinity

Description

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-7313 — CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote a... (8.7 HIGH)
  • CVE-2026-7312 — CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 t... (10.0 CRITICAL)
  • CVE-2026-7201 — CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 1... (8.8 HIGH)
  • CVE-2026-7198 — CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attack... (9.8 CRITICAL)
  • CVE-2026-8488 — Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation (4.3 MEDIUM)

Same CWE

  • CVE-2026-49218 — ImageMagick is free and open-source software used for editing and manipulating digital images (7.5 HIGH)
  • CVE-2024-21944 — Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a ... (5.3 MEDIUM)
  • CVE-2026-48110 — Russh is a Rust SSH client & server library (7.5 HIGH)
  • CVE-2026-48108 — Russh is a Rust SSH client & server library (5.3 MEDIUM)
  • CVE-2026-48107 — Russh is a Rust SSH client & server library (6.5 MEDIUM)