Priority HIGH 82
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.0055 · Published 2025-12-22 · No fix listed CWE-434
Priority HIGH 81
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without a…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.04347 · Published 2025-08-13 · Fixed in 4.7.1 CWE-22
Priority HIGH 70
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0038 · Published 2026-01-15 · No fix listed CWE-918
Priority HIGH 68
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00332 · Published 2025-01-22 · No fix listed CWE-79
Priority HIGH 67
Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0412 · Published 2023-05-18 · No fix listed CWE-91
Priority MEDIUM 59
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.61954 · Published 2020-12-30 · No fix listed CWE-79
Priority MEDIUM 48
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03481 · Published 2017-04-13 · No fix listed CWE-20
Priority MEDIUM 47
Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02812 · Published 2018-08-27 · No fix listed CWE-434
Priority MEDIUM 44
Umbraco is a ASP.NET CMS.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00715 · Published 2023-07-13 · Fixed in 10.6.1, 11.4.2 +1 CWE-284
Priority MEDIUM 42
Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0228 · Published 2020-03-16 · No fix listed CWE-434
Priority MEDIUM 41
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when in…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.09481 · Published 2020-12-30 · Fixed in 8.9.2 CWE-22
Priority MEDIUM 40
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.0035 · Published 2024-10-22 · Fixed in 14.3.1 CWE-79
Priority MEDIUM 40
Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01138 · Published 2022-01-18 · Fixed in 9.2.0 CWE-444
Priority LOW 39
Umbraco is a free and open source .NET content management system.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00646 · Published 2025-04-08 · Fixed in 14.3.4, 15.3.1 CWE-23
Priority LOW 36
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.01422 · Published 2014-12-27 · No fix listed CWE-287
Priority LOW 35
Umbraco is an ASP.NET content management system (CMS).
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00624 · Published 2023-12-12 · Fixed in 8.18.10, 10.8.1 +1 CWE-22
Priority LOW 34
Umbraco is an ASP.NET CMS.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00376 · Published 2026-03-10 · Fixed in 16.5.1, 17.2.1 +1 CWE-269
Priority LOW 34
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL.
CVSS 3.1HIGH 7.4· Network · No auth · User interaction · EPSS 0.01016 · Published 2022-01-18 · Fixed in 9.2.0 CWE-640
Priority LOW 33
Umbraco is a free and open source .NET content management system.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01609 · Published 2025-01-21 · Fixed in 14.3.2, 15.1.2 CWE-200
Priority LOW 33
Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02109 · Published 2020-03-16 · Fixed in 8.5.4 CWE-434
Priority LOW 31
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 6.7· Network · High privileges · No interaction · EPSS 0.00302 · Published 2026-03-10 · Fixed in 16.5.1, 17.2.1 +1 CWE-79
Priority LOW 31
A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00609 · Published 2024-11-04 · Fixed in 13.5.3, 14.3.2 +2 CWE-79
Priority LOW 31
Umbraco is an ASP.NET content management system (CMS).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.005 · Published 2023-12-12 · Fixed in 8.18.10, 10.8.1 +1 CWE-200
Priority LOW 30
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0039 · Published 2025-07-30 · Fixed in 13.9.3, 15.4.4 +1 CWE-200
Priority LOW 30
Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00343 · Published 2025-06-24 · Fixed in 10.8.111, 13.9.2 +1 CWE-497
Load more
THREATIST.IORead the docs