Known Vulnerabilities for products from Umbraco
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Umbraco".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-111624 json | Not Provided | 2026-10-16 | 2026-10-16 | |
| CVE-2026-69197 json | Not Provided | 2026-09-17 | 2026-09-17 | |
| CVE-2026-46616 json | Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to suppor... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-46609 json | Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an ... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2025-67288 json | An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a craft... | Not Provided | 2025-12-22 | 2026-07-08 |
| CVE-2025-66625 json | Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during ... | Not Provided | 2025-12-09 | 2026-10-14 |
| CVE-2024-55488 json | A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or... | Not Provided | 2025-01-22 | 2026-07-05 |
| CVE-2023-37267 json | Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permi... | 9.8 - CRITICAL | 2023-07-13 | 2023-07-25 |
| CVE-2023-32312 json | UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integratio... | 5.3 - MEDIUM | 2023-06-09 | 2023-06-20 |
| CVE-2022-22691 json | The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building ... | 7.4 - HIGH | 2022-01-18 | 2022-01-26 |
| CVE-2022-22690 json | Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever app... | 7.5 - HIGH | 2022-01-18 | 2022-01-26 |
| CVE-2021-47776 json | Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl paramete... | Not Provided | 2026-01-15 | 2026-10-08 |
| CVE-2021-37334 json | Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote... | 9.8 - CRITICAL | 2021-08-25 | 2021-11-28 |
| CVE-2021-34254 json | Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. | 6.1 - MEDIUM | 2021-06-28 | 2021-07-02 |
| CVE-2021-33224 json | File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted w... | Not Provided | 2023-02-24 | 2026-07-09 |
| CVE-2020-29454 json | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applica... | 4.3 - MEDIUM | 2020-12-02 | 2021-07-21 |
| CVE-2020-9472 json | Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functi... | 6.5 - MEDIUM | 2020-03-16 | 2020-03-19 |
| CVE-2020-9471 json | Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages fun... | 8.8 - HIGH | 2020-03-16 | 2020-03-19 |
| CVE-2020-7685 json | This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to u... | 7.5 - HIGH | 2020-07-28 | 2023-03-02 |
| CVE-2020-7210 json | Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts. | 4.3 - MEDIUM | 2020-01-23 | 2020-06-11 |
Known software with vulnerabilities from Umbraco
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Umbraco | Umbraco | 8.2.2 |
| Application | Umbraco | Umbracoforms | - |
| Application | Umbraco | Umbraco Cms | 4.10.0 |