CVE-2026-7195

Published: Jun 2, 2026Modified: Jul 22, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

Affected (6)

Products: Progress: Sitefinity

Progress

1 product

Sitefinity

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Progress Sitefinity	14.1.7800 ≤ version < 14.4.8152
Progress Sitefinity	15.0.8200 ≤ version < 15.0.8234
Progress Sitefinity	15.1.8300 ≤ version < 15.1.8335
Progress Sitefinity	15.2.8400 ≤ version < 15.2.8441
Progress Sitefinity	15.3.8500 ≤ version < 15.3.8531
Progress Sitefinity	15.4.8600 ≤ version < 15.4.8630

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026

Source: security@progress.com

Vendor Advisory

Timeline

No history available yet.