CVE-2024-35239

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-35245.4A vulnerability, which was classified as problematic, has been found in Campcodes Online Event Management System 1.0. This issue affects som CVE-2024-352405.4Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue wh CVE-2024-352418.8Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` comma CVE-2024-352428.8Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running insid CVE-2024-352449.1There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by CVE-2024-352456.7Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated CVE-2024-352467.5An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.CVE-2024-352475.5In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current imple CVE-2024-352487.3Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVE-2024-352498.8Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVE-2024-35255.4A vulnerability, which was classified as problematic, was found in Campcodes Online Event Management System 1.0. Affected is an unknown func CVE-2024-352507.8Windows Kernel-Mode Driver Elevation of Privilege Vulnerability