Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
umbraco umbraco cms vulnerabilities and exploits
(subscribe to this query)
668
VMScore
CVE-2014-10074
Umbraco prior to 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
Umbraco Umbraco Cms
356
VMScore
CVE-2020-29454
Editors/LogViewerController.cs in Umbraco up to and including 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
Umbraco Umbraco Cms
312
VMScore
CVE-2017-15279
Cross-site scripting (XSS) vulnerability in Umbraco CMS prior to 7.7.3 allows remote malicious users to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish....
Umbraco Umbraco Cms
312
VMScore
CVE-2020-5809
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.
Umbraco Umbraco Cms
356
VMScore
CVE-2020-5811
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
Umbraco Umbraco Cms
446
VMScore
CVE-2022-22690
Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds...
Umbraco Umbraco Cms
384
VMScore
CVE-2022-22691
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the ...
Umbraco Umbraco Cms
312
VMScore
CVE-2020-5810
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload.
Umbraco Umbraco Cms
517
VMScore
CVE-2021-34254
Umbraco CMS prior to 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx.
Umbraco Umbraco Cms
668
VMScore
CVE-2013-4793
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS prior to 6.0.4 does not require authentication, which allows remote malicious users to execute arbitrary ASP.NET code via a crafted SOAP request.
Umbraco Umbraco Cms
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »