CVE-2026-7313

MediumCVSS 4.9/10Last modified Jul 22, 2026

Description

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-731304.3Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits CVE-2026-731355.3Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whCVE-2026-731367.5Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfeCVE-2026-731377.7A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmReleasCVE-2026-73147.3A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/apCVE-2026-731405.3Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normCVE-2026-73157.3A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.pyCVE-2026-731555.3Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether thoCVE-2026-731565.3Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. SCVE-2026-731572.3Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolatioCVE-2026-731585.1Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style propertiesCVE-2026-731595.1Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper m