Umbraco
57 CVEs across 13 Umbraco products. Browse Umbraco vulnerabilities, severities, and proof-of-concept exploits.
Umbraco products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46616 | Medium | 5.4 | 2026-06-10 | Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail t… |
CVE-2026-46609 | Medium | 4.6 | 2026-06-10 | Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in… |
CVE-2026-31834 | High | 7.2 | 2026-03-10 | Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain cond… |
CVE-2026-31833 | Medium | 6.7 | 2026-03-10 | Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into pro… |
CVE-2026-31832 | Medium | 5.4 | 2026-03-10 | Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that… |
CVE-2026-27449 | High | 7.5 | 2026-02-26 | Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API… |
CVE-2026-24687 | Medium | 6.5 | 2026-01-29 | Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and… |
CVE-2025-68924 | High | 7.5 | 2026-01-16 | In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution. |
CVE-2021-47776 | Medium | 5.3 | 2026-01-15 | Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help… |
CVE-2025-67288 | Critical | 10.0 | 2025-12-22 | An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is dispute… |
CVE-2025-66625 | Medium | 4.9 | 2025-12-09 | Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an a… |
CVE-2012-10054 | Critical | 9.8 | 2025-08-13 | Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRS… |
CVE-2025-54425 | Medium | 5.3 | 2025-07-30 | Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from… |
CVE-2025-49147 | Medium | 5.3 | 2025-06-24 | Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request… |
CVE-2025-48953 | Medium | 5.5 | 2025-06-03 | Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that… |
CVE-2025-47280 | Medium | 6.1 | 2025-05-13 | Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2… |
CVE-2025-46736 | Medium | 5.3 | 2025-05-06 | Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API re… |
CVE-2025-32017 | High | 8.8 | 2025-04-08 | Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that e… |
CVE-2025-27602 | Medium | 4.9 | 2025-03-11 | Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via mani… |
CVE-2025-27601 | Medium | 4.3 | 2025-03-11 | Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package pri… |
CVE-2024-55488 | Medium | 6.5 | 2025-01-22 | A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE… |
CVE-2025-24012 | Medium | 4.6 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are a… |
CVE-2025-24011 | Medium | 5.3 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determin… |
CVE-2025-23041 | Medium | 5.8 | 2025-01-14 | Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated on… |
CVE-2024-10761 | Medium | 4.3 | 2024-11-04 | A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of th… |
CVE-2024-48929 | Medium | 4.2 | 2024-10-22 | Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8… |
CVE-2024-48927 | Medium | 4.6 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to… |
CVE-2024-48926 | Medium | 4.2 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10… |
CVE-2024-48925 | Unrated | | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. Th… |
CVE-2024-47819 | Medium | 4.2 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3… |
CVE-2024-43377 | Medium | 5.4 | 2024-08-20 | Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2. |
CVE-2024-43376 | Medium | 4.3 | 2024-08-20 | Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability… |
CVE-2024-35240 | Medium | 5.4 | 2024-05-28 | Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable at… |
CVE-2024-35239 | Low | 2.7 | 2024-05-28 | Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code i… |
CVE-2024-35218 | Medium | 4.2 | 2024-05-21 | Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring ma… |
CVE-2024-34071 | Medium | 6.1 | 2024-05-21 | Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it req… |
CVE-2024-32872 | Medium | 5.5 | 2024-04-24 | Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can mod… |
CVE-2024-29035 | Medium | 4.1 | 2024-04-17 | Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vu… |
CVE-2024-28868 | Low | 3.7 | 2024-03-20 | Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration… |
CVE-2023-49279 | Low | 3.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with… |
CVE-2023-49278 | Medium | 5.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can b… |
CVE-2023-49274 | Low | 3.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack i… |
CVE-2023-49273 | Medium | 5.4 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (… |
CVE-2023-49089 | High | 7.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permi… |
CVE-2023-48313 | Medium | 4.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XS… |
CVE-2023-48227 | Medium | 4.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send… |
CVE-2023-38694 | Low | 3.5 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a spe… |
CVE-2023-37267 | High | 7.5 | 2023-07-13 | Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was pat… |
CVE-2023-32312 | Low | 3.7 | 2023-06-09 | UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client sec… |
CVE-2019-25137 | High | 7.2 | 2023-05-18 | Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/… |
CVE-2021-33224 | Critical | 9.8 | 2023-02-24 | File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. |
CVE-2022-22691 | Medium | 6.8 | 2022-01-18 | The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be po… |
CVE-2022-22690 | High | 8.6 | 2022-01-18 | Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL… |
CVE-2021-37334 | Critical | 9.8 | 2021-08-25 | Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbi… |
CVE-2021-34254 | Medium | 6.1 | 2021-06-28 | Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. |
CVE-2020-5811 | Medium | 6.5 | 2020-12-30 | An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files bein… |
CVE-2020-5810 | Medium | 5.4 | 2020-12-30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which a… |
CVE-2020-5809 | Medium | 5.4 | 2020-12-30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing cont… |
CVE-2020-29454 | Medium | 4.3 | 2020-12-02 | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access. |
CVE-2020-7685 | Medium | 5.4 | 2020-07-28 | This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The pa… |
CVE-2020-9472 | Medium | 6.5 | 2020-03-16 | Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality. |
CVE-2020-9471 | High | 8.8 | 2020-03-16 | Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality. |
CVE-2020-7210 | Medium | 4.3 | 2020-01-23 | Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts. |
CVE-2019-13957 | Critical | 9.8 | 2019-10-02 | In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter. |
CVE-2018-17256 | Medium | 4.8 | 2018-11-27 | Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a co… |
CVE-2014-10074 | Critical | 9.8 | 2018-08-27 | Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .p… |
CVE-2017-15280 | Medium | 5.5 | 2017-10-12 | XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending… |
CVE-2017-15279 | Medium | 5.4 | 2017-10-12 | Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka no… |
CVE-2012-1301 | Critical | 9.8 | 2017-04-13 | The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter. |
CVE-2015-8815 | Medium | 6.1 | 2017-03-03 | Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name paramete… |
CVE-2015-8814 | High | 8.8 | 2017-03-03 | Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by… |
CVE-2015-8813 | High | 8.2 | 2017-03-03 | The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct serve… |
CVE-2013-4793 | | 2014-12-27 | The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentic… |