Skip to content
OpenAdvisories

Package · NuGet

UmbracoCms

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2021-47776

    Umbraco v8.14.1 - 'baseUrl' SSRF

    Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemote…

    umbraco Umbraco UmbracoCms NuGet
  • Medium 4.6
    CVE-2024-48927

    Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

    Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users …

    umbraco Umbraco-CMS Umbraco.Cms UmbracoCms NuGet
  • Medium 4.2
    CVE-2024-48926

    Umbraco CMS logout page displayed before session expiration

    Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. The Backoffice displays the logout page with a session…

    umbraco Umbraco-CMS Umbraco.Cms UmbracoCms NuGet
  • Low 3.7
    CVE-2024-28868

    Umbraco possible user enumeration vulnerability

    Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login s…

    umbraco Umbraco-CMS UmbracoCms NuGet
  • Medium 6.5
    CVE-2020-5811 Public exploit

    Authenticated path traversal in Umbraco CMS

    An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.

    UmbracoCms NuGet
  • Medium 4.3
    CVE-2020-29454

    Incorrect permission enforcement in UmbracoCms

    Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.

    UmbracoCms NuGet
  • Medium 6.5
    CVE-2020-9472

    Unrestricted Upload of File with Dangerous Type in Umbraco CMS

    Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

    UmbracoCms NuGet