CVE-2026-7195— CWE-20: Improper Input Validation in web services in Progress Sitefinity
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Sitefinity | 14.1.0< 14.4.0 | affected |
14.4.8100< 14.4.8152 | affected | ||
15.0.8200< 15.0.8234 | affected | ||
15.1.8300< 15.1.8335 | affected | ||
15.2.8400< 15.2.8441 | affected | ||
15.3.8500< 15.3.8531 | affected | ||
15.4.8600< 15.4.8630 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7195
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CWE-20: Improper Input Validation in web services in Progress Sitefinity
Source: NVD (National Vulnerability Database)
Vulnerability Description
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Sitefinity | 14.1.0 ~ 14.4.0 | - |
II. Public POCs for CVE-2026-7195
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7195
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-7195 (1)
Same Patch Batch · Progress Software · 2026-06-02 · 5 CVEs total
| CVE-2026-7312 | 10.0 CRITICAL | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity |
| CVE-2026-7198 | 9.8 CRITICAL | CWE-284: Improper Access Control in web services in Progress Sitefinity |
| CVE-2026-7201 | 8.8 HIGH | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Site |
| CVE-2026-7313 | 8.7 HIGH | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity |
IV. Related Vulnerabilities
Same product: Sitefinity
- CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7201
CWE-639: Authorization Bypass Through User-Controlled Key in - CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress - CVE-2025-1968
Progress Sitefinity 代码问题漏洞
Same vendor: Progress Software
- CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7201
CWE-639: Authorization Bypass Through User-Controlled Key in - CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress - CVE-2026-8488
Allocation of resources without limits or throttling vulnera
Same weakness: CWE-20
- CVE-2026-47201
authentik: XML Signature Wrapping in SAML Source ACS allows - CVE-2026-35049
wire-ios has Persistent Remote DoS via Integer Underflow - CVE-2026-45685
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on - CVE-2026-45678
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing ca - CVE-2026-45676
OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing a
V. Comments for CVE-2026-7195
No comments yet