{"id":"CVE-2019-25137","details":"Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.","modified":"2026-07-08T20:57:32.568336Z","published":"2023-05-18T07:15:08.623Z","references":[{"type":"EVIDENCE","url":"https://0xdf.gitlab.io/2020/09/05/htb-remote.html"},{"type":"EVIDENCE","url":"https://github.com/Ickarah/CVE-2019-25137-Version-Research"},{"type":"EVIDENCE","url":"https://github.com/noraj/Umbraco-RCE"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/46153"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/umbraco/umbraco-cms","events":[{"introduced":"0"},{"last_affected":"86aaf4ff038704b4def767fe5a3920b46b93a830"}],"database_specific":{"cpe":"cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.11.8"},{"last_affected":"7.15.10"}],"source":"CPE_RANGE"}}],"versions":["release-7.15.10","release-7.15.9","release-7.15.8","release-7.15.7","release-7.15.6","release-7.15.5","release-7.15.3","release-7.4.3","release-7.5.14","release-7.7.13","release-7.14.0","release/7.15.2","release-7.15.2","release-7.15.1","release-7.15.0","release-7.10.0","release-7.13.0","release-7.12.1","release-7.12.0","release-7.11.0","release-7.6.7","release-7.9.3","release-7.9.2","release-7.9.1","release-7.7.12","release-7.7.11","release-7.7.10","release-7.7.9","release-7.7.8","release-7.7.6","release-7.7.7","release-7.7.5","release-7.7.4","release-7.6.3","release-7.7.2","release-7.6.8","release-7.6.2","release-7.5.13","release-7.5.12","release-7.5.11","release-7.5.10","release-7.5.9","release-7.5.8","release-7.5.3","release-7.5.5","release-7.5.1","release-7.5.0","release-7.5.0-beta2","release-7.5.0-beta","release-7.4.2","release-7.4.1","release-7.4.0-beta2","release-7.4.0","release-7.4.0-RC1","release-7.2.0-beta2","release-7.2.0-beta","release-7.1.4","release-7.2.0-alpha","release-7.1.3","release-7.1.2","release-7.1.1","release-7.1.0","release-7.1.0-RC","release-7.0.0","release-7.0.0-RC","release-7.0.0-beta","release-6.1.0-beta","4.7.2","Release-4.6.0","Sprint-Juno-A","Release-4.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25137.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}