Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
umbraco umbraco cms vulnerabilities and exploits
(subscribe to this query)
384
VMScore
CVE-2022-22691
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the ...
Umbraco Umbraco Cms
NA
CVE-2023-37267
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
Umbraco Umbraco Cms
312
VMScore
CVE-2017-15279
Cross-site scripting (XSS) vulnerability in Umbraco CMS prior to 7.7.3 allows remote malicious users to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish....
Umbraco Umbraco Cms
383
VMScore
CVE-2017-15280
XML external entity (XXE) vulnerability in Umbraco CMS prior to 7.7.3 allows malicious users to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocu...
Umbraco Umbraco Cms
356
VMScore
CVE-2020-29454
Editors/LogViewerController.cs in Umbraco up to and including 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
Umbraco Umbraco Cms
NA
CVE-2019-25137
Umbraco CMS 4.11.8 up to and including 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.
Umbraco Umbraco Cms
1 Github repository
668
VMScore
CVE-2013-4793
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS prior to 6.0.4 does not require authentication, which allows remote malicious users to execute arbitrary ASP.NET code via a crafted SOAP request.
Umbraco Umbraco Cms
668
VMScore
CVE-2014-10074
Umbraco prior to 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
Umbraco Umbraco Cms
312
VMScore
CVE-2020-5810
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload.
Umbraco Umbraco Cms
356
VMScore
CVE-2020-5811
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
Umbraco Umbraco Cms
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
path traversal
CVE-2024-33545
CVE-2024-35725
CVE-2024-32704
overflow
file upload
CVE-2024-0230
CVE-2024-32705
CVE-2024-23692
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
NEXT »