CVE-2026-7195 — CWE-20: Improper Input Validation in web services in Progress Sitefinity

Description (CNA)

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

Affected (CNA)

Vendor / product	Versions
Progress Software / Sitefinity	affected 14.1.0 before 14.4.0; affected 14.4.8100 before 14.4.8152; affected 15.0.8200 before 15.0.8234; affected 15.1.8300 before 15.1.8335; affected 15.2.8400 before 15.2.8441; affected 15.3.8500 before 15.3.8531; affected 15.4.8600 before 15.4.8630

CWE

CWE-20

References

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.