Skip to content
OpenAdvisories

Product · Progress Software

Sitefinity

12 known vulnerabilities.

Sitefinity at a glance

Last 12 months
5
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 5 vulnerabilities, 2 critical Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202652
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202500
Feb 202500
Jan 202520
Dec 202400

Latest advisories

  • High max 8.8
    WID-SEC-2026-3744 1 CVE

    Progress Software Sitefinity Next.js Renderer SDK: Schwachstelle ermöglicht Manipulation von Dateien

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Progress Software Sitefinity Next.js Renderer SDK ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen offenzulegen.

    Progress Software Windows
  • High max 10.0
    WID-SEC-2026-1783 5 CVEs

    Progress Software Sitefinity: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Progress Software Sitefinity ausnutzen, um Sicherheitsmaßnahmen zu umgehen und so die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

    Progress Software Windows
  • Medium max 7.5
    WID-SEC-2025-1053 1 CVE

    Progress Software Sitefinity: Schwachstelle ermöglicht Denial of Service

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Progress Software Sitefinity ausnutzen, um einen Denial of Service Angriff durchzuführen.

    Progress Software Windows
  • Medium max 7.7
    WID-SEC-2025-0774 1 CVE

    Progress Software Sitefinity: Schwachstelle ermöglicht nicht spezifizierten Angriff

    Ein Angreifer kann eine Schwachstelle in Progress Software Sitefinity ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

    Progress Software Windows
  • High max 8.4
    WID-SEC-2025-0015 2 CVEs

    Progress Software Sitefinity: Mehrere Schwachstellen

    Ein entfernter Angreifer kann mehrere Schwachstellen in Progress Software Sitefinity ausnutzen, um Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.

    Progress Software Windows
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • High 8.7
    CVE-2026-7313

    CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity

    CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation…

    Progress Software Sitefinity
  • Critical 10.0
    CVE-2026-7312

    CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity

    CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows…

    Progress Software Sitefinity
  • High 8.8
    CVE-2026-7201

    CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity

    CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, …

    Progress Software Sitefinity
  • Critical 9.8
    CVE-2026-7198

    CWE-284: Improper Access Control in web services in Progress Sitefinity

    CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availabili…

    Progress Software Sitefinity
  • High 8.8
    CVE-2026-7195

    CWE-20: Improper Input Validation in web services in Progress Sitefinity

    CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a r…

    Progress Software Sitefinity
  • High 7.7
    CVE-2025-1968

    Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncom…

    Progress Software Sitefinity
  • High 8.4
    CVE-2024-11626

    Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scr…

    Progress Software Sitefinity
  • High 7.7
    CVE-2024-11625

    Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affe…

    Progress Software Sitefinity
  • Medium 5.3
    CVE-2024-4882

    URL Redirection to Arbitrary Site Exists in Sitefinity

    The user may be redirected to an arbitrary site in Sitefinity 15.1.8321.0 and previous versions.

    Progress Software Sitefinity
  • High 8.0
    CVE-2024-1636

    Potential Cross-Site Scripting (XSS) in the page editing area

    Potential Cross-Site Scripting (XSS) in the page editing area.

    Progress Software Sitefinity
  • High 8.8
    CVE-2024-1632

    Incorrect access control in the Sitefinity backend

    Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.

    Progress Software Sitefinity
  • Medium 4.7
    CVE-2023-6784

    Potential Use of the Sitefinity System for Distribution of Phishing Emails

    A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.

    Progress Software Sitefinity