CVE-2024-11626

published 2025-01-07

CVE-2024-11626: Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress…

Priority P4 19 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
progress	sitefinity	>= 15.0.8200 < 15.0.8230	15.0.8230
progress	sitefinity	>= 15.1.8300 < 15.1.8328	15.1.8328
progress	sitefinity	>= 15.2.8400 < 15.2.8422	15.2.8422
progress	sitefinity	>= 4.0 < 14.4.8143	14.4.8143
progress_software_corporation	sitefinity	15.0.8200 – 15.0.8229	—
progress_software_corporation	sitefinity	15.1.8300 – 15.1.8327	—
progress_software_corporation	sitefinity	15.2.8400 – 15.2.8421	—
progress_software_corporation	sitefinity	4.0 – 14.4.8142	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79