GHSA-95QR-67RX-9PGH Umbraco CMS vulnerable to stored XSS

A stored XSS vulnerability exists in Umbraco CMS = 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS...

Cross-site Scripting (XSS)

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization. An authenticated user can inject arbitrary JavaScript code into IFrames when editing content using the TinyMCE rich-text editor, as...

Umbraco CMS Authenticated File Upload

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

GHSA-H68C-4JH3-CP9J Umbraco CMS Authenticated File Upload

Umbraco Cloud 8.5.3 allows an authenticated file upload and consequently Remote Code Execution via the Install Packages functionality...

GHSA-GQQF-8CX6-9R7H Umbraco CMS vulnerable to CSRF

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

Umbraco CMS vulnerable to CSRF

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts...

Umbraco CMS vulnerable to CSRF

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

GHSA-5F6P-4HXQ-RJXM Umbraco CMS vulnerable to CSRF

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

GHSA-X34J-WXQ8-7VCM Umbraco CMS vulnerable to CSRF

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

Umbraco CMS vulnerable to CSRF

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

XML External Entity (XXE) Injection

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to XML External Entity XXE Injection via importDocumenttype.aspx.cs. Exploiting this vulnerability allows the attacker to obtain sensitive information by reading files on the server or sending TCP request...

GHSA-H2VQ-7GF2-QW9V Umbraco CMS XXE Vulnerability

XML external entity XXE vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts aka SSRF, related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs...

Umbraco CMS vulnerable to stored XSS

Cross-site scripting XSS vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" aka nodename parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and...

Cross-site Scripting (XSS)

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user input sanitization. Exploiting this vulnerability is possible via the PageName aka nodename parameter during the creation of a new page. Details Cross-site...

Umbraco CMS XXE Vulnerability

XML external entity XXE vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts aka SSRF, related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs...

GHSA-XJ94-RGF9-CQ37 Umbraco CMS vulnerable to stored XSS

Cross-site scripting XSS vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" aka nodename parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and...

Cross-site Scripting (XSS)

Overview UmbracoCms is a package that installs Umbraco Cms in your Visual Studio ASP.NET project Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization, allowing authenticated users to inject arbitrary web script via the Header Name of...

GHSA-WRRJ-R2J4-969W Umbraco CMS vulnerable to stored XSS

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

Umbraco CMS vulnerable to stored XSS

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

The vulnerability of the Umbraco CMS content management system, related to the manipulation of cross-site requests, allows a hacker to activate, deactivate, or delete user accounts.

The vulnerability of the Umbraco CMS content management system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to activate, deactivate, or delete user accounts through a specially created web page...