CVE-2025-68924
Quick assessment
Affected
Umbraco Forms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Umbraco Forms是Umbraco公司的一款表单构建工具。 Umbraco Forms 8.13.16及之前版本存在安全漏洞，该漏洞源于经过身份验证的攻击者可提供恶意WSDL URL作为数据源，可能导致远程代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-68924
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
从非可信控制范围包含功能例程
Source: CVE Program / CVE List V5
Vulnerability Title
Umbraco Forms 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Umbraco Forms是Umbraco公司的一款表单构建工具。 Umbraco Forms 8.13.16及之前版本存在安全漏洞，该漏洞源于经过身份验证的攻击者可提供恶意WSDL URL作为数据源，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-68924
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-68924
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-68924 (1)
IV. Related Vulnerabilities
Same product: Forms
-
CVE-2025-24775
WordPress Forms <= 2.9.0 - Arbitrary File Upload Vulnerabili -
CVE-2024-51791
WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vuln -
CVE-2021-24505
Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting -
CVE-2021-23388
Regular Expression Denial of Service (ReDoS) -
CVE-2019-2886
Oracle Fusion Middleware Forms组件安全漏洞
Same vendor: Umbraco
-
CVE-2026-69197
Umbraco: Delivery API leaks protected (Public Access) conten -
CVE-2026-46609
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confir -
CVE-2026-46616
Umbraco.Cms: Open Redirect Vulnerability in Surface Controll -
CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missin -
CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permiss
Same weakness: CWE-829
-
CVE-2026-100256
IntelliJ IDEA 2026.2.3前结构搜索RCE漏洞 -
CVE-2026-97150
baserCMS5 BcAddonMigrator任意文件读取删除漏洞 -
CVE-2026-87114
Kube-compare: container:// reference extraction runs the ima -
CVE-2026-54160
Network UPS Tools: A PWN Request in make-dist workflow can e -
CVE-2026-95985
Kiro IDE Allows Agentic Writes to Global Configurations Whil
V. Comments for CVE-2025-68924
No comments yet