CVE-2019-13957

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

CVE-2019-13957

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

Sql injection

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

CVE-2019-13957

CVE-2019-13957 affects Umbraco 7.3.8 with a SQL Injection vulnerability in the backoffice /PageWApprove/PageWApproveApi/GetInpectSearch endpoint via the nodeName parameter. The NVD entry lists high/critical impact metrics (CVSS v2 base score 7.5; CVSS v3.1 base score 9.8) indicating network attac...

CVE-2019-13957

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter...

Cross-site Scripting (XSS)

umbraco cms is vulnerable to cross-site scripting. A remotely authenticated attacker is able to inject arbitrary Javascript into a victim's browser via the Header Name when updating or removing public access of content...

Remote Code Execution (RCE)

umbraco is vulnerable to remote code execution RCE. Upload of .php files are not blocked in Umbraco.Web.UI/config/umbracoSettings.Release.config, which would allow an attacker to upload .php files containing malicious code, which will be executed when browsing to the file...

Cross-site Scripting (XSS)

umbraco cms is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the nodename parameter during the creation of a new page related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and...

XML External Entity (XXE)

umbraco cms is vulnerable to XML external entity XXE attacks. Lack of validation and permitting of external DTDs allow attackers to obtain confidential information via an SSRF from the XXE attack...

Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12....

Umbraco CMS 7.12.4 - (Authenticated) Remote Code Execution

Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link:...

Umbraco CMS 7.12.4 Remote Code Execution

Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12.4 Category: Webapps Tested...

Umbraco CMS 7.12.4 - (Authenticated) Remote Code Execution

Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators Dork: N/A Date: 2019-01-13 Exploit Author: Gregory DRAPERI & Hugo BOUTINON Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12.4 Category: Webapps Tested...

Umbraco CMS Cross-Site Scripting Vulnerability (CNVD-2018-24258)

Umbraco CMS is a Danish Umbraco company using ASP.Net build , Mysql for data storage content management system CMS. The system supports customized templates , manage users , rights definition of content and so on. A cross-site scripting vulnerability exists in Umbraco CMS version 7.12.3. A remote...

CVE-2018-17256

CVE-2018-17256 concerns a stored XSS vulnerability in Umbraco CMS 7.12.3 . The issue allows an authenticated user to inject arbitrary web script via the Header Name field of a content item (e.g., Blog, Content Page) and is triggered when updating or removing public access to content. Connected do...

CVE-2018-17256

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

CVE-2018-17256

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

Cross site scripting

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

CVE-2018-17256

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

Umbraco Code Execution Vulnerability

Umbraco is a Danish company Umbraco a set of use ASP.Net to build , Mysql for data storage content management system CMS. The system supports customized templates , manage users , define permissions on the content and so on. A code execution vulnerability exists in Umbraco versions prior to 7.2.0...