Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

Umbraco.Forms

4 known vulnerabilities (2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 medium, 2 low
Registry
NuGet

Advisories 4

  • CVE-2026-24687Medium 6.0

    Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac

    Affected: from 16.0.0, fixed in 16.4.1; from 17.0.0, fixed in 17.1.1.

  • Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

    Affected: from 7.0.0, fixed in 13.4.2; from 14.0.0, fixed in 15.1.2.

  • CVE-2025-23041Medium 5.8

    Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms

    Affected: fixed in 10.5.7; from 11.0.0-rc1, fixed in 13.2.2; from 14.0.0-beta001, fixed in 14.1.2.

  • Stored Cross-site Scripting on Components of Umbraco Forms

    Affected: from 13.0.0, fixed in 13.0.1; from 12.0.0, fixed in 12.2.2; from 10.0.0, fixed in 10.5.3; from 8.0.0, fixed in 8.13.13.