Umbraco vulnerabilities
52 CVEs and advisories name Umbraco as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-47819Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
- CVE-2024-43377Umbraco CMS Improper Access Control vulnerability
- CVE-2024-43376Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information
- CVE-2024-35240Stored Cross-site Scripting on Print Functionality in Umbraco Commerce
- CVE-2024-35239Stored Cross-site Scripting on Components of Umbraco Forms
- CVE-2024-35218Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
- CVE-2024-34071Open Redirect Bypass Protection
- CVE-2024-32872Umbraco Workflow's Backoffice users can execute arbitrary SQL
- CVE-2024-29035Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
- CVE-2024-28868Umbraco possible user enumeration vulnerability
- CVE-2023-49279Umbraco CMS vulnerable to stored XSS via SVG File Upload
- CVE-2023-49278Umbraco CMS brute force exploit can be used to collect valid usernames
- CVE-2023-49274Umbraco CMS SMTP misconfiguration exposes potential registered user email
- CVE-2023-49273Umbraco CMS vulnerable to Privilege Escalation using Spoofing
- CVE-2023-49089Umbraco CMS possible path traversal when creating packages from backoffice
- CVE-2023-48313Umbraco contains a DOM-XSS
- CVE-2023-48227Umbraco CMS Backoffice User can bypass "Publish" restriction
- CVE-2023-38694Umbraco CMS vulnerable to possible injection of HTML in an unintended form
- CVE-2023-37267Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
- CVE-2023-32312Client secret not mandatory in UmbracoIdentityExtensions
- CVE-2022-22690Umbraco Remote ApplicationURL Overwrite
- CVE-2022-22691Umbraco Password Reset URL Poison