Umbraco.Forms.Issues

>= 12.0.0, < 12.2.2

OTHER 1 CVE

< 8.13.16

OTHER 1 CVE

>= 13.0.0, < 13.0.1

OTHER 1 CVE

>= 14.0.0, < 14.1.2

OTHER 1 CVE

>= 11.0.0, < 13.2.2

OTHER 1 CVE

>= 10.0.0, < 10.5.3

OTHER 1 CVE

< 8.13.13

OTHER 1 CVE

>= 10.0.0, < 10.5.7

OTHER 1 CVE

CVE-2025-23041

Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.

MEDIUM Jan 14, 2025

CVE-2024-35239

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

LOW May 28, 2024