← Database

CVE-2026-46609

MEDIUM CVSS: 4.6 Published: 2026-06-10 Modified: 2026-06-17

Description

Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.

Affected Platforms

Umbraco Umbraco Cms

Weakness Type

CWE-79

References