Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

Umbraco.Cms.Web.Backoffice

4 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 high, 3 medium
Registry
NuGet

Advisories 4

  • CVE-2025-27602Medium 4.9

    Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

    Affected: fixed in 10.8.9; from 11.0.0-rc1, fixed in 13.7.1.

  • CVE-2024-34071Medium 6.1

    Open Redirect Bypass Protection

    Affected: from 8.18.5, fixed in 8.18.14; from 10.5.0, fixed in 10.8.6; from 12.0.0, fixed in 12.3.10; from 13.0.0, fixed in 13.3.1.

  • CVE-2024-29035Medium 4.1

    Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

    Affected: from 13.0.0, fixed in 13.1.1.

  • Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

    Affected: from 9.0.0, fixed in 10.6.1; from 11.0.0, fixed in 11.4.2; from 12.0.0, fixed in 12.0.1.