CVE-2026-7312— CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Sitefinity | 14.0.7700< 14.4.8152 | affected |
15.0.8200< 15.0.8234 | affected | ||
15.1.8300< 15.1.8335 | affected | ||
15.2.8400< 15.2.8441 | affected | ||
15.3.8500< 15.3.8531 | affected | ||
15.4.8600< 15.4.8630 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7312
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
Source: NVD (National Vulnerability Database)
Vulnerability Description
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Sitefinity | 14.0.7700 ~ 14.4.8152 | - |
II. Public POCs for CVE-2026-7312
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7312
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-7312 (1)
Same Patch Batch · Progress Software · 2026-06-02 · 5 CVEs total
| CVE-2026-7198 | 9.8 CRITICAL | CWE-284: Improper Access Control in web services in Progress Sitefinity |
| CVE-2026-7195 | 8.8 HIGH | CWE-20: Improper Input Validation in web services in Progress Sitefinity |
| CVE-2026-7201 | 8.8 HIGH | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Site |
| CVE-2026-7313 | 8.7 HIGH | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity |
IV. Related Vulnerabilities
Same product: Sitefinity
- CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7201
CWE-639: Authorization Bypass Through User-Controlled Key in - CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress - CVE-2026-7195
CWE-20: Improper Input Validation in web services in Progres - CVE-2025-1968
Progress Sitefinity 代码问题漏洞
Same vendor: Progress Software
- CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7201
CWE-639: Authorization Bypass Through User-Controlled Key in - CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress - CVE-2026-7195
CWE-20: Improper Input Validation in web services in Progres - CVE-2026-8488
Allocation of resources without limits or throttling vulnera
V. Comments for CVE-2026-7312
No comments yet