Browse CVEs

MEDIUM 5.3 CVE-2021-47776 Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard… Umbraco Cms No fix yet Fix from $1,6002026-01-15 CRITICAL 10.0 CVE-2025-67288 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this … Umbraco Cms Mitigation only Fix from $2,3002025-12-22 MEDIUM 6.5 CVE-2024-55488 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payl… Umbraco Cms No fix yet Fix from $1,6002025-01-22 CRITICAL 9.8 CVE-2021-33224 File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. Umbraco Forms Mitigation only Fix from $2,3002023-02-24 HIGH 7.5 CVE-2020-7685 This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file typ… Umbraco Forms Mitigation only Fix from $1,9502020-07-28 MEDIUM 6.5 CVE-2020-9472 Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality. Umbraco Cms No fix yet Fix from $1,6002020-03-16 HIGH 8.8 CVE-2020-9471 Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality. Umbraco Cms No fix yet Fix from $1,9502020-03-16 CRITICAL 9.8 CVE-2019-13957 In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter. Umbraco Mitigation only Fix from $2,3002019-10-02 CRITICAL 9.8 CVE-2012-1301 The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter. Umbraco Cms Mitigation only Fix from $2,3002017-04-13