Umbraco Cms vulnerabilities

• umbraco umbraco-cms Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning CVE-2026-117553 7.7 HighOctober 27, 2026
• umbraco umbraco-cms Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs CVE-2026-111624 6.3 MediumOctober 16, 2026
• umbraco umbraco-cms Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion CVE-2026-69197 Fix available 8.7 HighSeptember 17, 2026
• umbraco cms, umbraco-cms +1 more Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog CVE-2026-46609 Fix available 4.6 MediumMay 21, 2026
• umbraco cms, umbraco-cms +1 more Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers CVE-2026-46616 Fix available 5.4 MediumMay 21, 2026
• umbraco cms, umbraco-cms +1 more Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks CVE-2026-31834 Fix available 7.2 HighMarch 10, 2026
• umbraco cms, umbraco-cms +1 more Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering CVE-2026-31833 Fix available 6.7 MediumMarch 10, 2026
• umbraco cms, umbraco-cms +1 more Umbraco Backoffice API Allows Unauthorized Modification of Domain Data CVE-2026-31832 Fix available 5.4 MediumMarch 10, 2026
• umbraco, umbraco cms +1 more Umbraco v8.14.1 - 'baseUrl' SSRF CVE-2021-47776 6.9 MediumJanuary 15, 2026
• umbraco cms Umbraco CMS has an arbitrary file upload vulnerability CVE-2025-67288 10.0 CriticalDecember 22, 2025
• umbraco cms, umbraco-cms +1 more Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality CVE-2025-66625 Fix available 4.9 MediumDecember 9, 2025
• statamic cms Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVE-2012-10054 Public exploit 9.3 CriticalAugust 13, 2025
• umbraco cms, umbraco-cms +1 more Umbraco's Delivery API allows for cached requests to be returned with an invalid API key CVE-2025-54425 Fix available 5.3 MediumJuly 29, 2025
• umbraco cms, umbraco-cms +1 more Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements CVE-2025-49147 Fix available 5.3 MediumJune 24, 2025
• umbraco cms, umbraco-cms +1 more Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads CVE-2025-48953 Fix available 5.5 MediumJune 3, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Makes User Enumeration Feasible Based on Timing of Login Response CVE-2025-46736 Fix available 5.3 MediumMay 6, 2025
• umbraco umbraco-cms, cms +1 more Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users CVE-2025-32017 Fix available 8.8 HighApril 8, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content CVE-2025-27602 Fix available 4.9 MediumMarch 11, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality CVE-2025-27601 Fix available 4.3 MediumMarch 11, 2025
• umbraco cms Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting CVE-2024-55488 Disputed 6.5 MediumJanuary 22, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability CVE-2025-24012 Fix available 4.6 MediumJanuary 21, 2025
• umbraco cms, umbraco-cms +1 more Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes CVE-2025-24011 Public exploitFix available 5.3 MediumJanuary 21, 2025
• statamic cms Umbraco CMS Dashboard frame cross site scripting CVE-2024-10761 Fix available 6.9 MediumNovember 4, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out CVE-2024-48929 Fix available 4.2 MediumOctober 22, 2024
• umbraco umbraco-cms, cms +1 more Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice CVE-2024-48927 Fix available 4.6 MediumOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS logout page displayed before session expiration CVE-2024-48926 Fix available 4.2 MediumOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API CVE-2024-48925 Fix available 0.0 NoneOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section CVE-2024-47819 Fix available 4.2 MediumOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Improper Access Control vulnerability CVE-2024-43377 Fix available 5.4 MediumAugust 20, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information CVE-2024-43376 Fix available 4.3 MediumAugust 20, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane CVE-2024-35218 Fix available 4.2 MediumMay 21, 2024
• umbraco cms, umbraco-cms +1 more Open Redirect Bypass Protection CVE-2024-34071 Fix available 6.1 MediumMay 21, 2024
• umbraco cms, umbraco-cms +1 more Umbraco's Blind SSRF Leads to Port Scan by using Webhooks CVE-2024-29035 Fix available 4.1 MediumApril 17, 2024
• umbraco umbraco-cms, cms +1 more Umbraco possible user enumeration vulnerability CVE-2024-28868 Fix available 3.7 LowMarch 20, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to stored XSS via SVG File Upload CVE-2023-49279 Fix available 3.7 LowDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS brute force exploit can be used to collect valid usernames CVE-2023-49278 Fix available 5.3 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS SMTP misconfiguration exposes potential registered user email CVE-2023-49274 Fix available 3.7 LowDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to Privilege Escalation using Spoofing CVE-2023-49273 Fix available 5.4 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS possible path traversal when creating packages from backoffice CVE-2023-49089 Fix available 7.7 HighDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco contains a DOM-XSS CVE-2023-48313 Fix available 4.3 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS Backoffice User can bypass "Publish" restriction CVE-2023-48227 Fix available 4.3 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to possible injection of HTML in an unintended form CVE-2023-38694 Fix available 3.5 LowDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions CVE-2023-37267 Fix available 7.5 HighJuly 13, 2023
• umbraco cms Umbraco CMS 7.12.4 allows Remote Code Execution by authenticated administrators via msxsl:script... CVE-2019-25137 Public exploit 7.2 HighMay 18, 2023
• umbraco cms Umbraco Remote ApplicationURL Overwrite CVE-2022-22690 Fix available 8.6 HighJanuary 18, 2022
• umbraco cms Umbraco Password Reset URL Poison CVE-2022-22691 Fix available 6.8 MediumJanuary 18, 2022
• umbraco cms Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization... CVE-2021-34254 6.1 MediumJune 28, 2021
• umbraco cms Umbraco CMS vulnerable to stored XSS CVE-2020-5809 5.4 MediumDecember 30, 2020
• umbraco cms A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user... CVE-2020-5810 EPSS 62.0% 5.4 MediumDecember 30, 2020
• umbraco cms Authenticated path traversal in Umbraco CMS CVE-2020-5811 Public exploitFix available 6.5 MediumDecember 30, 2020
• Show olderLoading…