CVE-2024-35218

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-352198.3OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically gi CVE-2024-35228.8A vulnerability classified as critical has been found in Campcodes Online Event Management System 1.0. This affects an unknown part of the f CVE-2024-352207.4@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the CVE-2024-352214.3Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how R CVE-2024-352225.9Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri CVE-2024-352235.3Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invok CVE-2024-352245.4OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. Th CVE-2024-352256.1Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access t CVE-2024-352267.3Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions tem CVE-2024-352277.5Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352285.5Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.s CVE-2024-352295.3ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern