Security
فارسی
All products

umbraco.cms

NuGet · Package
29 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionCVE-2026-69197 · GHSA-WR57-HQMP-FGVH umbraco.cms NuGet High Fix reported
Umbraco CMS has an arbitrary file upload vulnerabilityCVE-2025-67288 · GHSA-54MJ-VCVJ-Q3V5 umbraco.cms NuGet Medium No fix reported
DOM-XSS on Backoffice login screen.CVE-2023-48313 · GHSA-V98M-398X-269R umbraco.cms NuGet Medium Fix reported
Using the directory back payload (“/../”) in a package name allows placement of package in other folders.CVE-2023-49089 · GHSA-6324-52PR-H4P5 umbraco.cms NuGet Low Fix reported
Stored XSS via SVG File UploadCVE-2023-49279 · GHSA-6XMX-85X3-4CV2 umbraco.cms NuGet Low Fix reported
Brute force exploit can be used to collect valid usernamesCVE-2023-49278 · GHSA-7X74-H8CW-QHXQ umbraco.cms NuGet Low Fix reported
Backoffice User can bypass "Publish" restrictionCVE-2023-48227 · GHSA-335X-5WCM-8JV2 umbraco.cms NuGet Low Fix reported
Umbraco.Cms: Open Redirect Vulnerability in Surface ControllersCVE-2026-46616 · GHSA-2QJJ-H6WP-C7H7 umbraco.cms NuGet Medium Fix reported
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialogCVE-2026-46609 · GHSA-VR9V-27GG-QGX4 umbraco.cms NuGet Medium Fix reported
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute FilteringCVE-2026-31833 · GHSA-VRQC-59MW-QQG7 umbraco.cms NuGet Medium Fix reported
Umbraco Affected by Vertical Privilege Escalation via Missing Authorization ChecksCVE-2026-31834 · GHSA-RHCG-3H8R-V6VP umbraco.cms NuGet High Fix reported
Umbraco Backoffice API Allows Unauthorized Modification of Domain DataCVE-2026-31832 · GHSA-FPVF-FVP5-996R umbraco.cms NuGet Medium Fix reported
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import FunctionalityCVE-2025-66625 · GHSA-HFV2-PF68-M33X umbraco.cms NuGet Medium Fix reported
Umbraco CMS disclosure of configured password requirements CVE-2025-49147 · GHSA-PGVC-6H2P-Q4F6 umbraco.cms NuGet Medium Fix reported
Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File UploadsCVE-2025-48953 · GHSA-FR6R-P8HV-X3C4 umbraco.cms NuGet Medium Fix reported
Umbraco Makes User Enumeration Feasible Based on Timing of Login ResponseCVE-2025-46736 · GHSA-4G8M-5MJ5-C8XG umbraco.cms NuGet Medium Fix reported
Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes CVE-2025-24011 · GHSA-HMG4-WWM5-P999 umbraco.cms NuGet Medium Fix reported
Umbraco has a Management API Vulnerability to Path Traversal With Authenticated UsersCVE-2025-32017 · GHSA-Q62R-8PPJ-XVF4 umbraco.cms NuGet High Fix reported
XSS/HTML Injection Vulnerability in Umbraco Preview BadgeCVE-2024-10761 · GHSA-69CG-W8VM-H229 umbraco.cms.web.commonumbraco.cms NuGet Medium Fix reported
Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook APICVE-2024-48925 · GHSA-4GP9-FF99-J6VJ umbraco.cms NuGet Low Fix reported