Vulnerability details

CVE-2026-7313

Progress Software Sitefinity

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity

CVSS 3.1

8.7High

Official description

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

CVSS scores

Score	Version	Source	Vector
8.7High	3.1	CVEProject cvelistV5 (CNA) (ProgressSoftware)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
Progress Software	Sitefinity	8.0.5700 ≤ v < 13.3.7652	CVEProject cvelistV5 (CNA)

References and advisories

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026 vendor-advisory

Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-02
Last updated: 2026-06-03
State: Published
Assigner (CNA): ProgressSoftware

Exploit prediction (EPSS)

0.31%

Probability of exploitation in 30 days

25%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total