CVE-2023-38694 (published 2023-12-12T17:09:08.237Z)
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.
Affected products: Vendor: umbraco
Product: Umbraco-CMS
Versions: >= 8.0.0, < 8.18.10, >= 9.0.0-rc001, < 10.7.0, >= 11.0.0-rc1, < 12.1.0