CVE-2026-7313

HIGH

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity

Title source: cna

Description

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026

Scores

CVSS v3 8.7

EPSS 0.0030

EPSS Percentile 21.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-522

Status published

Products (2)

progress/sitefinity 8.0.5700 - 13.3.7652

Progress Software/Sitefinity 8.0.5700 - 13.3.7652

Published Jun 02, 2026

Tracked Since Jun 02, 2026