CVE-2025-24012 MEDIUM

CVE-2025-24012: Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

Vendor Umbraco
Product Umbraco-CMS
Weakness CWE-79 · XSS
Published January 21, 2025
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch.

Key dates

02Disclosure timeline

January 21, 2025 CVE published
February 12, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-59430 Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink CVE-2025-60002 Junos Space: Template Definitions page is vulnerable to reflected cross-site script injection CVE-2023-3890 Campcodes Beauty Salon Management System edit-accepted-appointment.php cross site scripting CVE-2025-47618 WordPress BMI Adult & Kid Calculator plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2022-46181 Gotify server XSS vulnerability in the application image file upload