CVE-2024-35239lowCWE-79

CVE-2024-35239: falha de baixa gravidade em Umbraco.Forms.Issues

Stored Cross-site Scripting on Components of Umbraco Forms

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Umbraco.Forms.Issues+ Monitorar Umbraco.Forms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.7epss 0.3%
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
umbraco · Umbraco.Forms.Issues
CVEs relacionadas — Umbraco.Forms.Issues

No mesmo produto, das mais perigosas para as menos.

CVE-2026-24687MEDIUMUmbraco.Forms has path traversal and file enumeration vulnerability in Linux/MacEPSS 0.5%CVE-2025-23041MEDIUMShort and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.FormsEPSS 0.4%CVE-2025-47280LOWUmbraco.Forms has HTML injection vulnerability in 'Send email' workflowEPSS 0.3%