Skip to content
OpenAdvisories

Package · NuGet

Umbraco.Cms.Web.BackOffice

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 4.9
    CVE-2025-27602

    Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

    Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or del…

    umbraco Umbraco-CMS Umbraco.Cms.Web.BackOffice NuGet
  • Medium 6.1
    CVE-2024-34071

    Open Redirect Bypass Protection

    Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has…

    umbraco Umbraco-CMS UmbracoCms.Core Umbraco.Cms.Web.BackOffice NuGet
  • Medium 4.1
    CVE-2024-29035

    Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

    Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.

    umbraco Umbraco-CMS Umbraco.Cms.Web.BackOffice Umbraco.Cms.Core NuGet
  • High 7.5
    CVE-2023-37267

    Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

    Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.

    umbraco Umbraco-CMS Umbraco.Cms.Web.BackOffice Umbraco.Cms.Infrastructure NuGet