CVE-2026-7195CWE-20

CWE-20: Improper Input Validation in web services in Progress Sitefinity

High · published June 2, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-06-02T13:04Z
EPSS history
Timeline
  • 02 JUN 13:04Z
    CWE-20: Improper Input Validation in web services in Progress Sitefinity
    cvelistv5