Product by Umbraco

    Umbraco-CMS

    60 known vulnerabilities in Umbraco-CMS (Umbraco), 0 of them actively exploited (CISA KEV).

    Key figures

    60

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    5

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Umbraco-CMS (Umbraco)
    CriticalCVE-2012-10054

    Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

    		9.8
    CriticalCVE-2012-1301

    Umbraco-CMS: security vulnerability

    		9.8
    CriticalCVE-2014-10074

    Umbraco-CMS: Code Execution

    		9.8
    MediumCVE-2020-5810

    Umbraco CMS: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2020-5811

    Umbraco CMS: Path Traversal

    		6.5
    HighCVE-2019-25137

    Umbraco-CMS: Remote Code Execution

    		7.2
    HighCVE-2020-9471

    Umbraco-CMS: Remote Code Execution

    		8.8
    HighCVE-2026-69197

    Umbraco-CMS: Exposure of Sensitive Information to an Unauthorized Actor

    		—
    MediumCVE-2020-9472

    Umbraco-CMS: Remote Code Execution

    		6.5
    HighCVE-2026-117553

    Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning

    		7.5
    MediumCVE-2025-24011

    Umbraco-CMS: Exposure of Sensitive Information to an Unauthorized Actor

    		5.3
    CriticalCVE-2025-67288

    Umbraco-CMS: Unrestricted File Upload

    		10.0
    HighCVE-2022-22690

    Umbraco Remote ApplicationURL Overwrite

    		8.6
    HighCVE-2025-32017

    Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

    		8.8
    HighCVE-2022-22691

    Umbraco Password Reset URL Poison

    		6.8
    MediumCVE-2026-111624

    Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs

    		3.7
    CriticalCVE-2023-37267

    Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

    		7.5
    HighCVE-2023-49089

    Umbraco CMS possible path traversal when creating packages from backoffice

    		7.7
    MediumCVE-2017-15280

    Umbraco-CMS: XML External Entity (XXE)

    		5.5
    MediumCVE-2024-10761

    Umbraco CMS Dashboard frame cross site scripting

    		4.3
    HighCVE-2026-31834

    Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

    		7.2
    MediumCVE-2021-47776

    Umbraco v8.14.1 - 'baseUrl' SSRF

    also in 1 other product

    		5.3
    MediumCVE-2020-7210

    Umbraco-CMS: Cross-Site Request Forgery (CSRF)

    		4.3
    MediumCVE-2017-15279

    Umbraco-CMS: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2021-34254

    Umbraco-CMS: Open Redirect

    		6.1

    All vulnerabilities in search

    All products by Umbraco