XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

Impact Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components. Patches Will be patched in 14.3.2 and 15.1.2. Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil...

CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

CVE-2025-24012

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

Malicious code in dops-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7424d9aa8c2bde93f8112704428131dce54ddc6083fbc8eb880e289c3b1737e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-294 Malicious code in dops-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7424d9aa8c2bde93f8112704428131dce54ddc6083fbc8eb880e289c3b1737e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-components-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5ebed80f557fd2e81a446cf38988b615c07e4459d17b289756a2646e2b8fd54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-316 Malicious code in ui-components-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5ebed80f557fd2e81a446cf38988b615c07e4459d17b289756a2646e2b8fd54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-components-highlight-vdom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c058680e21b489b3504441b59346650d2d8f204795eda46ba03d8c9585e58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-269 Malicious code in aem-react-editable-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fdeb2ad3adadbbe85aa33bbaa3ed1728c9019c415d8c1e218db5f1f72661482 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aem-react-editable-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fdeb2ad3adadbbe85aa33bbaa3ed1728c9019c415d8c1e218db5f1f72661482 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aem-angular-editable-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fca4a582054bbff21e69768e3b5934e358df88c79f61073e65cf4272a8510544 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-268 Malicious code in aem-angular-editable-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fca4a582054bbff21e69768e3b5934e358df88c79f61073e65cf4272a8510544 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-4817

The issue affects Node.js, specifically all end-of-life versions up to v17.9.1, which no longer receive support or updates, including security patches. This can expose systems to potential security risks due to unaddressed software vulnerabilities or dependencies. The vulnerable versions of Node....

PT-2025-5259 · Umbraco · Umbraco

Name of the Vulnerable Software and Affected Versions: Umbraco versions 14.0.0 through 14.3.1 Umbraco versions 15.0.0 through 15.1.1 Description: The issue allows authenticated users to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components...

PT-2025-4818

The affected software is Node.js, specifically all End-of-Life EOL versions that are no longer supported and do not receive updates, including security patches. These versions may expose systems to potential security risks due to unaddressed software issues or dependencies, such as the use of...

Umbraco cross-site scripting vulnerabilities

Umbraco is an open source Content Management System CMS written in C by the Danish company Umbraco. A cross-site scripting vulnerability exists in Umbraco version 14.0.0 and earlier, which originates from an authenticated user viewing certain localized back-end components and can easily lead to a...

CVE-2025-24012: Improper Neutralization of Input During Web Page Generation

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

CVE-2025-21505: Allocation of Resources Without Limits or Throttling

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...

PT-2025-5265

Name of the Vulnerable Software and Affected Versions Mjolnir version 1.9.0 Description Mjolnir is a moderation tool for Matrix. It responds to management commands from any room the bot is a member of, potentially allowing users who are not operators to use the bot's functions, including server...