CVE-2025-23041

Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-20

• https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-9v8m-qv22-f268Patch, Third Party Advisory

Published

Jan 14, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-23036WeGIA is an open source web manager with a focus on the Port…5.4
• CVE-2025-23037WeGIA is an open source web manager with a focus on the Port…5.4
• CVE-2025-23038WeGIA is an open source web manager with a focus on the Port…5.4
• CVE-2025-23039Caido is a web security auditing toolkit. A Cross-Site Scrip…5.2
• CVE-2025-2304A Privilege Escalation through a Mass Assignment exists in C…9.4
• CVE-2025-23040GitHub Desktop is an open-source Electron-based GitHub app d…6.6
• CVE-2025-23042Gradio is an open-source Python package that allows quick bu…7.5
• CVE-2025-23044PwnDoc is a penetration test report generator. There is no C…8.1
• CVE-2025-23045Computer Vision Annotation Tool (CVAT) is an interactive vid…9.8
• CVE-2025-23046GLPI is a free asset and IT management software package. Sta…7.5
• CVE-2025-23047Cilium is a networking, observability, and security solution…6.5
• CVE-2025-23048In some mod_ssl configurations on Apache HTTP Server 2.4.35 …9.1