Skip to content
Noroxi

umbraco records

70 published records for vendor umbraco.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 1.4%
Pre-auth RCE
6
With a fix record
74.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

70 records
  • CVE-2012-10054
    60This week

    Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

    CriticalCVSS 9.3WeaponizedEPSS 4%

    umbraco · umbraco cmsAug 13, 2025

  • CVE-2020-5810
    40Plan

    A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.

    MediumCVSS 5.4No exploitEPSS 61%

    umbraco · umbraco cmsDec 30, 2020

  • CVE-2012-1301
    40Plan

    The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter.

    CriticalCVSS 9.8No exploitEPSS 3%

    umbraco · umbraco cmsApr 13, 2017

  • CVE-2014-10074
    40Plan

    Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not blo

    CriticalCVSS 9.8No exploitEPSS 2%

    umbraco · umbraco cmsAug 27, 2018

  • CVE-2021-37334
    40Plan

    Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution

    CriticalCVSS 9.8No exploitEPSS 2%

    umbraco · formsAug 25, 2021

  • CVE-2025-67288
    40Plan

    An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.

    CriticalCVSS 10.0No exploitEPSS 0%

    umbraco · umbraco cmsDec 22, 2025

  • CVE-2019-13957
    39Monitor

    In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    umbraco · umbracoOct 2, 2019

  • CVE-2021-33224
    39Monitor

    File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and a

    CriticalCVSS 9.8No exploitEPSS 0%

    umbraco · umbraco formsFeb 24, 2023

  • CVE-2023-37267
    39Monitor

    Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

    CriticalCVSS 9.8No exploitEPSS 0%

    umbraco · umbraco cmsJul 13, 2023

  • CVE-2020-9471
    36Monitor

    Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.

    HighCVSS 8.8No exploitEPSS 2%

    umbraco · umbraco cmsMar 16, 2020

  • CVE-2015-8813
    35Monitor

    The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attacke

    HighCVSS 8.2Proof of conceptEPSS 11%

    umbraco · umbracoMar 3, 2017

  • CVE-2025-32017
    35Monitor

    Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

    HighCVSS 8.8No exploitEPSS 0%

    umbraco · umbraco cmsApr 8, 2025

  • CVE-2015-8814
    35Monitor

    Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks

    HighCVSS 8.8No exploitEPSS 0%

    umbraco · umbracoMar 3, 2017

  • CVE-2024-47819
    34Monitor

    Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

    HighCVSS 8.7No exploitEPSS 0%

    umbraco · umbraco cmsOct 22, 2024

  • CVE-2013-4793
    30Monitor

    The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does no

    HighCVSS 7.5No exploitEPSS 1%

    umbraco · umbraco cmsDec 27, 2014

  • CVE-2022-22690
    30Monitor

    Umbraco Remote ApplicationURL Overwrite

    HighCVSS 7.5No exploitEPSS 1%

    umbraco · umbraco cmsJan 18, 2022

  • CVE-2020-7685
    30Monitor

    This affects all versions of package UmbracoForms.

    HighCVSS 7.5No exploitEPSS 0%

    umbraco · umbraco formsJul 28, 2020

  • CVE-2025-68924
    30Monitor

    In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for rem

    HighCVSS 7.5No exploitEPSS 0%

    umbraco · umbraco formsJan 16, 2026

  • CVE-2020-5811
    29Monitor

    An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in a

    MediumCVSS 6.5Proof of conceptEPSS 9%

    umbraco · umbraco cmsDec 30, 2020

  • CVE-2019-25137
    29Monitor

    Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSele

    HighCVSS 7.2Proof of conceptEPSS 4%

    umbraco · umbraco cmsMay 18, 2023

  • CVE-2022-22691
    29Monitor

    Umbraco Password Reset URL Poison

    HighCVSS 7.4No exploitEPSS 1%

    umbraco · umbraco cmsJan 18, 2022

  • CVE-2026-31834
    28Monitor

    Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

    HighCVSS 7.2No exploitEPSS 0%

    umbraco · umbraco cmsMar 10, 2026

  • CVE-2020-9472
    27Monitor

    Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

    MediumCVSS 6.5No exploitEPSS 2%

    umbraco · umbraco cmsMar 16, 2020

  • CVE-2024-10761
    27Monitor

    Umbraco CMS Dashboard frame cross site scripting

    MediumCVSS 6.9No exploitEPSS 0%

    umbraco · umbraco cmsNov 4, 2024

  • CVE-2021-47776
    27Monitor

    Umbraco v8.14.1 - 'baseUrl' SSRF

    MediumCVSS 6.9No exploitEPSS 0%

    umbraco · umbraco cmsJan 15, 2026