CVE-2025-24875: Cross-Site Request Forgery (CSRF)

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None SameSite=None. This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues...

CVE-2025-24874: Improper Restriction of Rendered UI Layers or Frames

SAP Commerce Backoffice uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence,...

PT-2025-6133 · Sap · Sap Commerce

Name of the Vulnerable Software and Affected Versions: SAP Commerce affected versions not specified Description: The issue is related to SAP Commerce setting certain cookies with the SameSite attribute configured to None by default. This includes authentication cookies used in SAP Commerce...

The vulnerability in the web application for managing and administering the SAP Commerce Backoffice platform, related to the lack of protective measures for the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the web application for managing and administering the SAP Commerce Backoffice platform is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Cross-site Scripting (XSS)

Umbraco is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization in certain localized backoffice components, allowing authenticated users to inject malicious scripts when viewing these components...

GHSA-WV8V-RMW2-25WC XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

Impact Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components. Patches Will be patched in 14.3.2 and 15.1.2. Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil...

XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

Impact Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components. Patches Will be patched in 14.3.2 and 15.1.2. Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when viewing certain localized backoffice components. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The...

CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

PT-2025-5259 · Umbraco · Umbraco

Name of the Vulnerable Software and Affected Versions: Umbraco versions 14.0.0 through 14.3.1 Umbraco versions 15.0.0 through 15.1.1 Description: The issue allows authenticated users to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components...

CVE-2025-24012: Improper Neutralization of Input During Web Page Generation

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

CVE-2024-11124 TimGeyssens UIOMatic uioMaticObject.r sql injection

A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical. This vulnerability affects unknown code of the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2024-11124: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical. This vulnerability affects unknown code of the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2024-51995 Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker can request any route we want as long as we specify an operation that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in UI.php to the ajax.render.php page which does not...

Remote Code Execution (RCE)

Umbraco is vulnerable to remote code execution. The vulnerability is due to improper handling of SVG files, where script tags within these files are not properly validated or stripped, allowing potential code execution when previewed by Backoffice users in full-screen mode...

The vulnerability in the web application for managing and administering the SAP Commerce Backoffice platform arises from the lack of protective measures for the website structure. This allows attackers who operate remotely to carry out cross-site scripting attacks.

The vulnerability in the web application for managing and administering the SAP Commerce Backoffice platform is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

GHSA-5955-CWV4-H7QH Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process...

Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process...

GHSA-FP6Q-GCCW-7QQM Umbraco CMS logout page displayed before session expiration

Impact The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are...