Back to Database
Status published
Medium
CVE-2023-48313
Umbraco contains a DOM-XSS
Vulnerability Description
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-48313
Credits & Attribution
No credits recorded in the NVD database.
More from umbraco
View All →CVE-2025-66625
Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality
Medium
4.9
CVE-2025-54425
Umbraco's Delivery API allows for cached requests to be returned with an invalid API key
Medium
5.3
CVE-2025-49147
Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements
Medium
5.3
CVE-2025-48953
Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Medium
5.5
CVE-2025-47280
Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
Low
2.3
Affected Vendor
umbraco
View all reports →Affected Software
Umbraco-CMS
Vulnerable Versions:
>= 10.0.0, < 10.8.1, >= 11.0.0-rc1, < 12.3.4
Timeline
Official Publish:
December 12th, 2023
Last Modified:
August 28th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N