CVE-2026-7195

Published: Jun 2, 2026Modified: Jul 22, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

Affected (6)

Products: Progress: Sitefinity

Progress

1 product

Sitefinity

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Progress Sitefinity	From 14.1.7800 to 14.4.8152
Progress Sitefinity	From 15.0.8200 to 15.0.8234
Progress Sitefinity	From 15.1.8300 to 15.1.8335
Progress Sitefinity	From 15.2.8400 to 15.2.8441
Progress Sitefinity	From 15.3.8500 to 15.3.8531
Progress Sitefinity	From 15.4.8600 to 15.4.8630

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026

Source: security@progress.com

Vendor Advisory

Timeline

No history available yet.