Umbraco

CVE-2026-117553 Oct 27, 13:07 HIGH PATCH This Week

Back-office account takeover in Umbraco CMS (all versions before 17.7.2 and 18.0.0 through 18.2.1) lets unauthenticated attackers poison the Host header to register attacker-controlled OAuth redirect URIs for the back-office OpenIddict clients, then send a signed-in back-office user an authorization link using response_mode=form_post so the authorization code is delivered to the attacker, who redeems it with HTTP Basic client credentials. A successful chain yields an authenticated back-office session with the victim's privileges - full site control, and code execution through Razor templates if the victim is an administrator. Exploitation is conditional: it only works where the web server, IIS without host-name bindings, or a reverse proxy forwards requests for unrecognised host names to Umbraco, and it requires a logged-in operator to open the attacker's link (CVSS 3.1 AV:N/AC:H/PR:N/UI:R, vendor CVSS 4.0 7.7); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patches exist in 17.7.2 and 18.2.2.

CVE-2026-69197 Sep 17, 15:44 NuGet HIGH PATCH GHSA This Week

Information disclosure in Umbraco CMS allows an unauthenticated caller (CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N, independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, score 8.7) to read the name, route and id of Public Access-protected nodes, and - by appending ?expand - their full serialized property values, whenever those protected nodes are merely referenced from an unprotected page through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid or Rich Text Editor blocks. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy code path also bypasses allowed/disallowed content-type alias restrictions for referenced content. All releases prior to 13.15.1, 17.5.3 and 18.0.2 are affected, but the Delivery API is opt-in and not enabled by default and exploitation additionally requires a content structure in which protected content is referenced from unprotected content; there is no integrity or availability impact, no public exploit identified at time of analysis, and no confirmed active exploitation. When the Delivery API is gated by the organization-wide API key rather than DeliveryApi:PublicAccess, a key holder can still bypass per-node Public Access through the same expansion path, so the disclosure is not limited to the anonymous configuration.

CVE-2026-31834 Mar 10, 22:16 NuGet HIGH PATCH This Week

Privilege escalation in Umbraco CMS versions 15.3.1 through 16.5.0 and 17.x before 17.2.2 allows authenticated backoffice users with user management permissions to assign themselves elevated privileges by bypassing authorization checks on role assignments. An attacker with these permissions could gain administrative access to the CMS without proper privilege validation. No patch is currently available for affected installations.

CVE-2012-10054 Aug 13, 21:15 CRITICAL POC PATCH THREAT Act Now

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 75.9%.

CVE-2026-111624 Oct 16, 17:39 MEDIUM PATCH This Month

Unauthenticated clients that can reach an Umbraco CMS backoffice can complete the SignalR negotiate handshake against the PreviewHub and BackofficeHub endpoints and receive the refreshed notifications those hubs broadcast, disclosing content keys for unpublished content and revealing when editors are actively working. The flaw affects Umbraco CMS releases before 17.7.1 and before 18.2.1 and is rated medium severity (vendor CVSS 4.0 base 6.3; independently assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L), with the practical leak limited to read-only metadata that only flows while editorial activity is in progress. No public exploit identified at time of analysis, and no evidence of confirmed active exploitation; the vendor has published patched releases and upstream fix commits.

CVE-2026-31833 Mar 10, 22:16 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET CMS. From 16.2.0 to versions up to 16.5.1 is affected by cross-site scripting (xss) (CVSS 6.7).

CVE-2026-31832 Mar 10, 22:16 NuGet MEDIUM PATCH This Month

Umbraco CMS versions 14.0.0 through 16.5.0 and 17.0.0-17.2.1 contain an authorization bypass in a backoffice API endpoint that allows authenticated editors to assign domain configurations to content nodes they lack permission to access. An attacker with valid credentials could exploit this to modify domain settings on restricted content, potentially affecting content visibility or routing. The vulnerability affects Umbraco deployments without patches 16.5.1 or 17.2.2 applied.

CVE-2026-24687 Jan 29, 20:16 NuGet MEDIUM PATCH This Month

Authenticated users in Umbraco Forms versions 16 and 17 can exploit a path traversal vulnerability to read arbitrary files on Mac and Linux systems running the CMS. An attacker with backoffice access can enumerate and access sensitive files through the export endpoint by manipulating the fileName parameter. No patch is currently available, though the vulnerability is mitigated by restricting backoffice access and blocking path traversal sequences at the WAF level.

CVE-2025-68924 Jan 16, 19:16 NuGet HIGH This Week

Umbraco Forms versions up to 8.13.16 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.5).

CVE-2021-47776 Jan 15, 16:16 NuGet MEDIUM POC This Month

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. [CVSS 5.3 MEDIUM]

CVE-2025-67288 Dec 22, 19:15 NuGet CRITICAL Act Now

Arbitrary code execution in Umbraco CMS 16.3.3 is claimed via upload of a crafted PDF file that abuses insufficient file-type validation (CWE-434), potentially leading to server-side code execution. The finding is explicitly DISPUTED by Umbraco, which states that enforcing upload validation is the deploying administrator's responsibility per documentation, mirroring the earlier CVE-2023-49279. No public exploit is confirmed and EPSS is low (0.50%, 39th percentile), so despite the nominal CVSS 10.0 this reflects a contested, configuration-dependent condition rather than a proven turnkey RCE.

CVE-2025-49147 Jun 24, 18:15 NuGet MEDIUM PATCH This Month

A remote code execution vulnerability in versions 10.0.0 (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

CVE-2025-48953 Jun 03, 19:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available.

CVE-2025-47280 May 13, 17:16 NuGet LOW POC PATCH Monitor

Umbraco Forms is a form builder that integrates with the Umbraco content management system. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-46736 May 06, 17:16 NuGet MEDIUM PATCH This Month

Umbraco is a free and open source .NET content management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2025-32017 Apr 08, 16:15 NuGet HIGH PATCH This Week

Umbraco is a free and open source .NET content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-55488 Jan 22, 16:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-24012 Jan 21, 16:15 LIB MEDIUM PATCH Monitor

Umbraco is a free and open source .NET content management system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2025-24011 Jan 21, 16:15 NuGet MEDIUM PATCH This Month

Umbraco is a free and open source .NET content management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 31.2%.

CVE-2025-23041 Jan 14, 19:15 NuGet MEDIUM PATCH This Month

Umbraco.Forms is a web form framework written for the nuget ecosystem. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-10761 Nov 04, 05:15 NuGet MEDIUM POC PATCH This Month

A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-48929 Oct 22, 16:15 NuGet MEDIUM PATCH This Month

Umbraco is a free and open source .NET content management system. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2024-48927 Oct 22, 16:15 NuGet MEDIUM PATCH This Month

Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-48926 Oct 22, 16:15 NuGet LOW PATCH Monitor

Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2024-48925 Oct 22, 16:15 NuGet MEDIUM PATCH This Month

Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-47819 Oct 22, 16:15 LIB HIGH PATCH This Week

Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-43377 Aug 20, 15:15 NuGet MEDIUM PATCH This Month

Umbraco CMS is an ASP.NET CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-43376 Aug 20, 15:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-35239 May 28, 21:16 NuGet MEDIUM PATCH This Month

Umbraco Commerce is an open source dotnet web forms solution. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-35218 May 21, 14:15 NuGet MEDIUM PATCH This Month

Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-34071 May 21, 14:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET CMS used by more than 730.000 websites. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.

CVE-2024-29035 Apr 17, 15:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.

CVE-2024-28868 Mar 20, 20:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2023-49279 Dec 12, 20:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-49278 Dec 12, 20:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-49274 Dec 12, 20:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-49273 Dec 12, 19:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-49089 Dec 12, 19:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-48313 Dec 12, 18:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-48227 Dec 12, 17:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-38694 Dec 12, 17:15 NuGet MEDIUM PATCH This Month

Umbraco is an ASP.NET content management system (CMS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-37267 Jul 13, 14:15 NuGet CRITICAL PATCH Act Now

Umbraco is a ASP.NET CMS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2023-32312 Jun 09, 20:15 MEDIUM PATCH This Month

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2021-33224 Feb 24, 16:15 CRITICAL Act Now

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-37334 Aug 25, 22:15 CRITICAL PATCH Act Now

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-34254 Jun 28, 16:15 MEDIUM This Month

Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-5811 Dec 30, 16:15 NuGet MEDIUM POC PATCH This Month

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-5810 Dec 30, 16:15 MEDIUM POC THREAT This Month

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-5809 Dec 30, 16:15 NuGet MEDIUM POC This Month

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-29454 Dec 02, 02:15 NuGet MEDIUM PATCH This Month

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-7685 Jul 28, 17:15 NuGet HIGH This Week

This affects all versions of package UmbracoForms. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-9472 Mar 16, 20:15 NuGet MEDIUM POC PATCH This Month

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-9471 Mar 16, 20:15 NuGet HIGH POC This Week

Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-7210 Jan 23, 13:15 NuGet MEDIUM POC PATCH This Month

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-13957 Oct 02, 19:15 CRITICAL Act Now

In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2018-17256 Nov 27, 19:29 NuGet MEDIUM This Month

Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2017-15280 Oct 12, 08:29 NuGet MEDIUM PATCH This Month

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

CVE-2017-15279 Oct 12, 08:29 NuGet MEDIUM PATCH This Month

Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2012-1301 Apr 13, 17:59 CRITICAL Act Now

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2015-8815 Mar 03, 16:59 MEDIUM POC This Month

Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to (1) the media page, (2) the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2015-8814 Mar 03, 16:59 NuGet HIGH PATCH This Week

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2015-8813 Mar 03, 16:59 NuGet HIGH POC PATCH THREAT Act Now

The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 82.8%.

CVE-2013-4793 Dec 27, 18:59 HIGH This Week

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.