CVE-2026-7195: Progress Software Sitefinity, невалидиран вход

Описание

Оригинално описание

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

Засегнати продукти

• Progress Software Sitefinity: 14.1.0 преди 14.4.0; 14.4.8100 преди 14.4.8152; 15.0.8200 преди 15.0.8234; 15.1.8300 преди 15.1.8335; 15.2.8400 преди 15.2.8441; 15.3.8500 преди 15.3.8531; 15.4.8600 преди 15.4.8630

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Други уязвимости в Progress Software Sitefinity

• 8.7CVE-2026-7313
• 10.0CVE-2026-7312
• 8.8CVE-2026-7201
• 9.8CVE-2026-7198

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-7195
• https://nvd.nist.gov/vuln/detail/CVE-2026-7195
• https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026