Progress Sitefinity
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Progress Sitefinity.
By the Year
In 2025 there have been 0 vulnerabilities in Progress Sitefinity. Last year, in 2024 Sitefinity had 3 security vulnerabilities published. Right now, Sitefinity is on track to have less security vulnerabilities in 2025 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 0 | 0.00 |
| 2024 | 3 | 5.77 |
| 2023 | 3 | 6.50 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 2 | 8.15 |
| 2018 | 1 | 7.50 |
It may take a day or so for new Sitefinity vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Progress Sitefinity Security Vulnerabilities
Progress Sitefinity before 15.0.0
CVE-2023-27636
5.4 - Medium
- June 16, 2024
Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
XSS
Potential Cross-Site Scripting (XSS) in the page editing area.
CVE-2024-1636
5.4 - Medium
- February 28, 2024
Potential Cross-Site Scripting (XSS) in the page editing area.
XSS
Low-privileged users with access to the Sitefinity backend may obtain sensitive information
CVE-2024-1632
6.5 - Medium
- February 28, 2024
Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.
CVE-2023-6784
4.3 - Medium
- December 20, 2023
A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647
CVE-2023-29376
5.4 - Medium
- April 10, 2023
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potential XSS by privileged users in Sitefinity to media libraries.
XSS
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647
CVE-2023-29375
9.8 - Critical
- April 10, 2023
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the SharePoint connector.
Unrestricted File Upload
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password
CVE-2019-17392
9.8 - Critical
- November 26, 2019
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.
Weak Password Recovery Mechanism for Forgotten Password
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts
CVE-2019-7215
6.5 - Medium
- June 06, 2019
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.
Insufficient Session Expiration
An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.
CVE-2018-17055
7.5 - High
- September 28, 2018
An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.
Unrestricted File Upload
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey
CVE-2017-9248
9.8 - Critical
- July 03, 2017
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.
Insufficiently Protected Credentials
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Progress Sitefinity or by Progress? Click the Watch button to subscribe.
