CVE-2024-35239 LOW

CVE-2024-35239: Stored Cross-site Scripting on Components of Umbraco Forms

Vendor Umbraco
Product Umbraco.Forms.Issues
Weakness CWE-79 · XSS
Published May 28, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

2.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

Key dates

02Disclosure timeline

May 28, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability CVE-2025-8368 Portabilis i-Educar pesquisa_pessoa_lst.php cross site scripting CVE-2023-4599 Email Encoder <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-12473 RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter CVE-2025-2590 code-projects Human Resource Management System recruitment.go UpdateRecruitmentById cross site scripting