UM
Product
Umbraco-CMS
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 5High 9Medium 43Low 2
Watch
Add Umbraco-CMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-67288 | 10.0 | Dec 22 | An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file Affected: 16.3.3 |
| CVE-2012-10054 | 9.8 | Aug 13 | Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that… Affected: before 4.7.1 |
| CVE-2023-37267 | 9.8 | Jul 13 | Umbraco is a ASP.NET CMS Affected: 10.0.0 before 10.6.1; 11.0.0 before 11.4.2; 12.0.0 before 12.0.1 |
| CVE-2014-10074 | 9.8 | Aug 27 | Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files Affected: before 7.2.0 |
| CVE-2012-1301 | 9.8 | Apr 13 | The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter Affected: 4.7.0 |
| CVE-2025-32017 | 8.8 | Apr 8 | Umbraco is a free and open source .NET content management system Affected: 14.0.0 before 14.3.4; 15.0.0 before 15.3.1 |
| CVE-2020-9471 | 8.8 | Mar 16 | Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality Affected: 8.5.3 |
| CVE-2026-69197 | 8.7 | Sep 17 | Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion Affected: >= 12.0.0, < 13.15.1; >= 14.0.0-rc1, < 17.5.3; >= 18.0.0, < 18.0.2 |
| CVE-2024-47819 | 8.7 | Oct 22 | Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0 Affected: 14.0.0 before 14.3.1 |
| CVE-2026-117553 New | 7.5 | Oct 27 | Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning Affected: before 17.7.2; 18.0.0 before 18.2.2 |
| CVE-2022-22690 | 7.5 | Jan 18 | Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to… Affected: before 9.2.0 |
| CVE-2022-22691 | 7.4 | Jan 18 | The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL Affected: before 9.2.0 |
| CVE-2026-31834 | 7.2 | Mar 10 | Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks Affected: >= 15.3.1, < 16.5.1; >= 17.0.0, < 17.2.1 |
| CVE-2019-25137 | 7.2 | May 18 | Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to… Affected: 4.11.8 through 7.15.10 |
| CVE-2026-31833 | 6.7 | Mar 10 | Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering Affected: >= 16.2.0, < 16.5.1; >= 17.0.0, < 17.2.1 |
| CVE-2025-48953 | 6.5 | Jun 3 | Umbraco is an ASP.NET content management system (CMS) Affected: 14.0.0 before 15.4.2 |
| CVE-2024-55488 | 6.5 | Jan 22 | A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload Affected: 14.3.1 |
| CVE-2024-48925 | 6.5 | Oct 22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0 Affected: 14.0.0 before 14.3.0 |
| CVE-2023-49089 | 6.5 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.0 |
| CVE-2020-5811 | 6.5 | Dec 30 | An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of… Affected: through 8.9.1 |
| CVE-2020-9472 | 6.5 | Mar 16 | Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality Affected: 8.5.3 |
| CVE-2025-27602 | 6.4 | Mar 11 | Umbraco is a free and open source .NET content management system Affected: before 10.8.9; 11.0.0 before 13.7.1 |
| CVE-2026-46616 | 6.1 | Jun 10 | Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers Affected: < 13.14.0; >= 17.3.0-rc, < 17.4.0 |
| CVE-2024-34071 | 6.1 | May 21 | Umbraco is an ASP.NET CMS used by more than 730.000 websites Affected: 8.18.5 before 8.18.14; 10.5.0 before 10.8.6; 12.0.0 before 12.3.10; 13.0.0 before 13.3.1 |
| CVE-2023-48313 | 6.1 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2021-34254 | 6.1 | Jun 28 | Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx Affected: before 7.15.7 |
| CVE-2017-15280 | 5.5 | Oct 12 | XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to… Affected: through 7.7.2 |
| CVE-2026-31832 | 5.4 | Mar 10 | Umbraco Backoffice API Allows Unauthorized Modification of Domain Data Affected: >= 14.0.0, < 16.5.1; >= 17.0.0, < 17.2.0 |
| CVE-2025-24012 | 5.4 | Jan 21 | Umbraco is a free and open source .NET content management system Affected: 14.0.0 before 14.3.2; 15.0.0 before 15.1.2 |
| CVE-2023-49279 | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 7.0.0 before 7.15.11; 8.0.0 before 8.18.9; 10.0.0 before 10.7.0; 11.0.0 before 11.5.0; 12.0.0 before 12.2.0 |
| CVE-2023-49273 | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2023-38694 | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 9.0.0 before 10.7.0; 11.0.0 before 12.1.0 |
| CVE-2020-5810 | 5.4 | Dec 30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current Affected: through 8.9.1 |
| CVE-2020-5809 | 5.4 | Dec 30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current Affected: through 8.9.1 |
| CVE-2017-15279 | 5.4 | Oct 12 | Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter… Affected: through 7.7.2 |
| CVE-2021-47776 | 5.3 | Jan 15 | Umbraco v8.14.1 - 'baseUrl' SSRF Affected: 8.14.1 |
| CVE-2025-54425 | 5.3 | Jul 30 | Umbraco is an ASP.NET CMS Affected: 13.0.0 before 13.9.3; 15.0.0 before 15.4.4; 16.0.0 before 16.1.1 |
| CVE-2025-49147 | 5.3 | Jun 24 | Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1 Affected: 10.0.0 before 10.8.11; 13.0.0 before 13.9.2 |
| CVE-2025-46736 | 5.3 | May 6 | Umbraco is a free and open source .NET content management system Affected: before 10.8.10; 10.9.0 before 13.8.1 |
| CVE-2025-24011 | 5.3 | Jan 21 | Umbraco is a free and open source .NET content management system Affected: 14.0.0 before 14.3.2; 15.0.0 before 15.1.2 |
| CVE-2024-43376 | 5.3 | Aug 20 | Umbraco is an ASP.NET CMS Affected: 14.0.0 before 14.1.2 |
| CVE-2024-29035 | 5.3 | Apr 17 | Umbraco is an ASP.NET CMS Affected: 13.0.0 before 13.1.1 |
| CVE-2024-28868 | 5.3 | Mar 20 | Umbraco is an ASP.NET content management system Affected: 10.0.0 before 10.8.5 |
| CVE-2023-49278 | 5.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2023-49274 | 5.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2025-66625 | 4.9 | Dec 9 | Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality Affected: 10.0.0, < 13.12.1 |
| CVE-2024-35218 | 4.8 | May 21 | Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites Affected: 8.0.0 before 8.18.13; 10.0.0 before 10.8.4; 12.0.0 before 12.3.7; 13.0.0 before 13.1.1 |
| CVE-2018-17256 | 4.8 | Nov 27 | Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content… Affected: 7.12.3 |
| CVE-2026-46609 | 4.6 | Jun 10 | Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog Affected: >= 14.0.0, < 17.4.0 |
| CVE-2024-48927 | 4.6 | Oct 22 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x… Affected: 8.0 before 8.18.15; 10.0 before 10.8.7; 13.0 before 13.5.2 |