TI-2026-34268 CVE-2026-46609 · GHSA-vr9v-27gg-qgx4
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
Priority LOW 20
Umbraco is an ASP.NET CMS.
Vulnerabilities
57 records
TI-2026-34272 CVE-2026-46616 · GHSA-2qjj-h6wp-c7h7
Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
Priority LOW 26
Umbraco is an ASP.NET CMS.
TI-2026-24387 CVE-2026-31834 · GHSA-rhcg-3h8r-v6vp
Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
Priority LOW 34
Umbraco is an ASP.NET CMS.
TI-2026-24386 CVE-2026-31833 · GHSA-vrqc-59mw-qqg7
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Priority LOW 31
Umbraco is an ASP.NET CMS.
TI-2026-24385 CVE-2026-31832 · GHSA-fpvf-fvp5-996r
Umbraco Backoffice API Allows Unauthorized Modification of Domain Data
Priority LOW 24
Umbraco is an ASP.NET CMS.
TI-2021-22392 CVE-2021-47776 · GHSA-h66j-xm43-47pp
Umbraco v8.14.1 - 'baseUrl' SSRF
Priority HIGH 70
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints.
TI-2025-41183 CVE-2025-67288 · GHSA-54mj-vcvj-q3v5
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute…
Priority HIGH 82
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.
TI-2025-41019 CVE-2025-66625 · GHSA-hfv2-pf68-m33x
Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality
Priority LOW 22
Umbraco is an ASP.NET CMS.
TI-2012-05477 CVE-2012-10054 · GHSA-c8gg-qc8v-6jfx
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
Priority HIGH 81
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without a…
TI-2025-34230 CVE-2025-54425 · GHSA-75vq-qvhr-7ffr
Umbraco's Delivery API allows for cached requests to be returned with an invalid API key
Priority LOW 30
Umbraco is an ASP.NET CMS.
TI-2025-31227 CVE-2025-49147 · GHSA-pgvc-6h2p-q4f6
Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements
Priority LOW 30
Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1.
TI-2025-31091 CVE-2025-48953 · GHSA-fr6r-p8hv-x3c4
Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Priority LOW 28
Umbraco is an ASP.NET content management system (CMS).
TI-2025-29407 CVE-2025-46736 · GHSA-4g8m-5mj5-c8xg
Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Priority LOW 30
Umbraco is a free and open source .NET content management system.
TI-2025-23141 CVE-2025-32017 · GHSA-q62r-8ppj-xvf4
Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Priority LOW 39
Umbraco is a free and open source .NET content management system.
TI-2025-20412 CVE-2025-27602 · GHSA-wx5h-wqfq-v698
Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
Priority LOW 28
Umbraco is a free and open source .NET content management system.
TI-2025-20411 CVE-2025-27601 · GHSA-6ffg-mjg7-585x
Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
Priority LOW 20
Umbraco is a free and open source .NET content management system.
TI-2024-36846 CVE-2024-55488
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers…
Priority HIGH 68
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
TI-2025-17779 CVE-2025-24012 · GHSA-wv8v-rmw2-25wc
Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability
Priority LOW 24
Umbraco is a free and open source .NET content management system.
TI-2025-17778 CVE-2025-24011 · GHSA-hmg4-wwm5-p999
Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Priority LOW 33
Umbraco is a free and open source .NET content management system.
TI-2024-09975 CVE-2024-10761 · GHSA-69cg-w8vm-h229
Umbraco CMS Dashboard frame cross site scripting
Priority LOW 31
A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1.
TI-2024-32624 CVE-2024-48929 · GHSA-wxw9-6pv9-c3xc
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Priority LOW 19
Umbraco is a free and open source .NET content management system.
TI-2024-32622 CVE-2024-48927 · GHSA-5955-cwv4-h7qh
Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Priority LOW 24
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15.
TI-2024-32621 CVE-2024-48926 · GHSA-fp6q-gccw-7qqm
Umbraco CMS logout page displayed before session expiration
Priority LOW 19
Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15.
TI-2024-32620 CVE-2024-48925 · GHSA-4gp9-ff99-j6vj
Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
Priority LOW 29
Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0.
TI-2024-32086 CVE-2024-47819 · GHSA-c5g6-6xf7-qxp3
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
Priority MEDIUM 40
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0.