UM
Product
Umbraco-CMS
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 5High 9Medium 43Low 2
Watch
Add Umbraco-CMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-31833 | 6.7 | Mar 10 | Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering Affected: >= 16.2.0, < 16.5.1; >= 17.0.0, < 17.2.1 |
| CVE-2025-48953 | 6.5 | Jun 3 | Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads Affected: >= 14.0.0, < 15.4.2 |
| CVE-2024-55488 | 6.5 | Jan 22 | A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload Affected: 14.3.1 |
| CVE-2024-48925 | 6.5 | Oct 22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0 Affected: 14.0.0 before 14.3.0 |
| CVE-2023-49089 | 6.5 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.0 |
| CVE-2020-5811 | 6.5 | Dec 30 | An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of… Affected: through 8.9.1 |
| CVE-2020-9472 | 6.5 | Mar 16 | Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality Affected: 8.5.3 |
| CVE-2025-27602 | 6.4 | Mar 11 | Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content Affected: < 10.8.9; >= 11.0.0-rc1, < 13.7.1 |
| CVE-2026-46616 | 6.1 | Jun 10 | Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers Affected: < 13.14.0; >= 17.3.0-rc, < 17.4.0 |
| CVE-2024-34071 | 6.1 | May 21 | Umbraco is an ASP.NET CMS used by more than 730.000 websites Affected: 8.18.5 before 8.18.14; 10.5.0 before 10.8.6; 12.0.0 before 12.3.10; 13.0.0 before 13.3.1 |
| CVE-2023-48313 | 6.1 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2021-34254 | 6.1 | Jun 28 | Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx Affected: before 7.15.7 |
| CVE-2017-15280 | 5.5 | Oct 12 | XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to… Affected: through 7.7.2 |
| CVE-2026-31832 | 5.4 | Mar 10 | Umbraco Backoffice API Allows Unauthorized Modification of Domain Data Affected: >= 14.0.0, < 16.5.1; >= 17.0.0, < 17.2.0 |
| CVE-2025-24012 | 5.4 | Jan 21 | Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability Affected: >= 14.0.0, < 14.3.2; >= 15.0.0, < 15.1.2 |
| CVE-2023-49279 | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 7.0.0 before 7.15.11; 8.0.0 before 8.18.9; 10.0.0 before 10.7.0; 11.0.0 before 11.5.0; 12.0.0 before 12.2.0 |
| CVE-2023-49273 | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2023-38694 | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 9.0.0 before 10.7.0; 11.0.0 before 12.1.0 |
| CVE-2020-5810 | 5.4 | Dec 30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current Affected: through 8.9.1 |
| CVE-2020-5809 | 5.4 | Dec 30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current Affected: through 8.9.1 |
| CVE-2017-15279 | 5.4 | Oct 12 | Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter… Affected: through 7.7.2 |
| CVE-2021-47776 | 5.3 | Jan 15 | Umbraco v8.14.1 - 'baseUrl' SSRF Affected: 8.14.1 |
| CVE-2025-54425 | 5.3 | Jul 30 | Umbraco's Delivery API allows for cached requests to be returned with an invalid API key Affected: >= 13.0.0, < 13.9.3; >= 15.0.0, < 15.4.4; >= 16.0.0, < 16.1.1 |
| CVE-2025-49147 | 5.3 | Jun 24 | Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements Affected: >= 10.0.0, < 10.8.111; >= 13.0.0, < 13.9.2 |
| CVE-2025-46736 | 5.3 | May 6 | Umbraco Makes User Enumeration Feasible Based on Timing of Login Response Affected: >= 11.0.0-rc1, < 13.8.1; < 10.8.10 |
| CVE-2025-24011 | 5.3 | Jan 21 | Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes Affected: >= 14.0.0, < 14.3.2; >= 15.0.0, < 15.1.2 |
| CVE-2024-43376 | 5.3 | Aug 20 | Umbraco is an ASP.NET CMS Affected: 14.0.0 before 14.1.2 |
| CVE-2024-29035 | 5.3 | Apr 17 | Umbraco is an ASP.NET CMS Affected: 13.0.0 before 13.1.1 |
| CVE-2024-28868 | 5.3 | Mar 20 | Umbraco is an ASP.NET content management system Affected: 10.0.0 before 10.8.5 |
| CVE-2023-49278 | 5.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2023-49274 | 5.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 10.0.0 before 10.8.1; 12.0.0 before 12.3.4 |
| CVE-2025-66625 | 4.9 | Dec 9 | Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality Affected: 10.0.0, < 13.12.1 |
| CVE-2024-35218 | 4.8 | May 21 | Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites Affected: 8.0.0 before 8.18.13; 10.0.0 before 10.8.4; 12.0.0 before 12.3.7; 13.0.0 before 13.1.1 |
| CVE-2018-17256 | 4.8 | Nov 27 | Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content… Affected: 7.12.3 |
| CVE-2026-46609 | 4.6 | Jun 10 | Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog Affected: >= 14.0.0, < 17.4.0 |
| CVE-2024-48927 | 4.6 | Oct 22 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x… Affected: 8.0 before 8.18.15; 10.0 before 10.8.7; 13.0 before 13.5.2 |
| CVE-2025-27601 | 4.3 | Mar 11 | Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality Affected: >= 15.0.0-rc1, < 15.2.3; < 14.3.3 |
| CVE-2024-10761 | 4.3 | Nov 4 | A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1 Affected: 12.3.6 |
| CVE-2024-43377 | 4.3 | Aug 20 | Umbraco CMS is an ASP.NET CMS Affected: 14.0.0 before 14.1.2 |
| CVE-2023-48227 | 4.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 9.0.0 before 10.7.0; 11.0.0 before 12.3.0 |
| CVE-2020-29454 | 4.3 | Dec 2 | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access Affected: 8.0.0 through 8.9.1 |
| CVE-2020-7210 | 4.3 | Jan 23 | Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts Affected: 8.2.2 |
| CVE-2024-48929 | 4.2 | Oct 22 | Umbraco is a free and open source .NET content management system Affected: 10.0 before 10.8.7; 13.0 before 13.5.2 |
Showing 43