Sitefinity

Every one of the 25 is a mark on the map. Named now: 1 to 25, most at risk first.

1. Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination. Also, it is transmitted…CVE-2017-18179Progress · 2.8% likely

   CWE-287

2. Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is specified using a certa…CVE-2017-18178Progress · 2.3% likely

   CWE-601

3. Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or ga…CVE-2017-15883Progress · 1.9% likely

   CWE-287

4. Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.CVE-2023-27636Progress · CVSS 6.5 · 1.3% likely

   CWE-79

5. Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.CVE-2019-17392Progress · 1.1% likely

   CWE-640

6. Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. T…CVE-2019-7215Progress · 1.1% likely

   CWE-613

7. An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.CVE-2018-17055Progress · 1.0% likely

   CWE-434

8. An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is pote…CVE-2023-29375Progress · CVSS 9.8 · 0.8% likely

   CWE-434

9. Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1.CVE-2017-18177Progress · 0.7% likely

   CWE-79

10. Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1.CVE-2017-18176Progress · 0.7% likely

    CWE-79

11. Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element. This is fixe…CVE-2017-18175Progress · 0.7% likely

    CWE-79

12. Incorrect access control in the Sitefinity backendCVE-2024-1632Progress Software Corporation · CVSS 8.8 · 0.5% likely

    CWE-284

13. CWE-284: Improper Access Control in web services in Progress SitefinityCVE-2026-7198Progress Software · CVSS 9.8 · 0.4% likelycovered by CyberSIXT

    CWE-284

14. CWE‑522: Insufficiently Protected Credentials in web services in Progress SitefinityCVE-2026-7312Progress Software · CVSS 10 · 0.4% likelycovered by CyberSIXT

    CWE-522

15. CWE-20: Improper Input Validation in web services in Progress SitefinityCVE-2026-7195Progress Software · CVSS 8.8 · 0.4% likely

    CWE-20

16. An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is pote…CVE-2023-29376Progress · CVSS 5.4 · 0.4% likely

    CWE-79

17. Potential Cross-Site Scripting (XSS) in the page editing areaCVE-2024-1636Progress Software Corporation · CVSS 8 · 0.4% likely

    CWE-79

18. URL Redirection to Arbitrary Site Exists in SitefinityCVE-2024-4882Progress Software Corporation · CVSS 5.3 · 0.4% likely

    CWE-601

19. Potential Use of the Sitefinity System for Distribution of Phishing EmailsCVE-2023-6784Progress Software Corporation · CVSS 4.7 · 0.4% likely

    CWE-20

20. Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue aff…CVE-2024-11626Progress Software Corporation · CVSS 8.4 · 0.4% likely

    CWE-79

21. CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress SitefinityCVE-2026-7201Progress Software · CVSS 8.8 · 0.3% likely

    CWE-639

22. Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay…CVE-2025-1968Progress Software Corporation · CVSS 7.7 · 0.3% likely

    CWE-613

23. : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through…CVE-2024-11627Progress · CVSS 6.8 · 0.3% likely

    CWE-613

24. CWE‑522: Insufficiently Protected Credentials in web services in Progress SitefinityCVE-2026-7313Progress Software · CVSS 8.7 · 0.3% likely

    CWE-522

25. Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 t…CVE-2024-11625Progress Software Corporation · CVSS 7.7 · 0.3% likely

    CWE-209

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.