https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:51:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265961 EUVD-2026-265961 https://cve.radiocsirt.org/vuln/euvd-2026-265961 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68924 <p>In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.</p> <p>In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-68924 https://cve.radiocsirt.org/vuln/ghsa-vrgw-pc9c-qrrc <p><strong>Affected:</strong> NuGet: UmbracoForms</p> <p>### Impact Within Umbraco Forms, configuring a malicious URL on the Webservice data source can result in Remote Code Execution. This affects all Umbraco Forms versions running on .NET Framework (up to and including version 8).</p> <p>### Patches The affected Umbraco Forms versions are all End-of-Life (EOL) and not supported anymore, hence no patches will be released. Upgrading to any of the currently supported versions (v13, v16 or v17) is recommended.</p> <p>### Workarounds If none of the configured Forms data sources uses the Webservice type, it can be safely excluded by adding the following code to the application. This will completely remove the option to select/use this data source within the Backoffice and thereby mitigate the vulnerability.</p> <p>```c# using Umbraco.Core.Composing; using Umbraco.Forms.Core.Providers; using Umbraco.Forms.Core.Providers.DatasourceTypes;</p> <p>internal sealed class RemoveFormsWebserviceDataSourceTypeComposer : IUserComposer { public void Compose(Composition composition) =&gt; composition.WithCollectionBuilder&lt;DataSourceCollectionBuilder&gt;().Exclude&lt;Webservice&gt;(); } ```</p> <p>Any Webservice data source that is configured and still in use should be replaced with a custom implementation instead, before applying the above code. If this is not feasible, the vulnerability can be minimized by revoking the &#39;Manage Data Sources&#39; from any non-administrator user and/or inheriting from the default `Umbraco.Forms.Core.Providers.DatasourceTypes.Webservice` class and ove…</p> <p><strong>Affected:</strong> NuGet: UmbracoForms</p> <p>### Impact Within Umbraco Forms, configuring a malicious URL on the Webservice data source can result in Remote Code Execution. This affects all Umbraco Forms versions running on .NET Framework (up to and including version 8).</p> <p>### Patches The affected Umbraco Forms versions are all End-of-Life (EOL) and not supported anymore, hence no patches will be released. Upgrading to any of the currently supported versions (v13, v16 or v17) is recommended.</p> <p>### Workarounds If none of the configured Forms data sources uses the Webservice type, it can be safely excluded by adding the following code to the application. This will completely remove the option to select/use this data source within the Backoffice and thereby mitigate the vulnerability.</p> <p>```c# using Umbraco.Core.Composing; using Umbraco.Forms.Core.Providers; using Umbraco.Forms.Core.Providers.DatasourceTypes;</p> <p>internal sealed class RemoveFormsWebserviceDataSourceTypeComposer : IUserComposer { public void Compose(Composition composition) =&gt; composition.WithCollectionBuilder&lt;DataSourceCollectionBuilder&gt;().Exclude&lt;Webservice&gt;(); } ```</p> <p>Any Webservice data source that is configured and still in use should be replaced with a custom implementation instead, before applying the above code. If this is not feasible, the vulnerability can be minimized by revoking the &#39;Manage Data Sources&#39; from any non-administrator user and/or inheriting from the default `Umbraco.Forms.Core.Providers.DatasourceTypes.Webservice` class and ove…</p> https://cve.radiocsirt.org/vuln/ghsa-vrgw-pc9c-qrrc