Skip to content
OpenAdvisories

Package · NuGet

UmbracoForms

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2025-68924

    UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation

    In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.

    umbraco Forms UmbracoForms NuGet
  • Low 2.3
    CVE-2025-47280

    Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

    Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email mes…

    umbraco Umbraco.Forms.Issues Umbraco.Forms UmbracoForms NuGet
  • Medium 5.8
    CVE-2025-23041

    Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms

    Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, an…

    umbraco Umbraco.Forms.Issues Umbraco.Forms UmbracoForms NuGet
  • Medium 5.4
    CVE-2020-7685

    Insecure Defaults

    This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom wo…

    UmbracoForms NuGet