Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

UmbracoCms.Core

5 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 medium
Registry
NuGet

Advisories 5

  • CVE-2024-35218Medium 4.2

    Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane

    Affected: from 8.0.0, fixed in 8.18.13; from 10.0.0, fixed in 10.8.4; from 12.0.0, fixed in 12.3.7; from 13.0.0, fixed in 13.1.1.

  • CVE-2024-34071Medium 6.1

    Open Redirect Bypass Protection

    Affected: from 8.18.5, fixed in 8.18.14; from 10.5.0, fixed in 10.8.6; from 12.0.0, fixed in 12.3.10; from 13.0.0, fixed in 13.3.1.

  • A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.

    Affected: through 8.9.1.

  • Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.

    Affected: through 8.5.3.

  • Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.

    Affected: fixed in 8.5.0.