Umbraco CMS

Umbraco possible user enumeration vulnerability

Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

Umbraco's Delivery API allows for cached requests to be returned with an invalid API key

Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality

Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.

Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane

Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.

Umbraco CMS Backoffice User can bypass "Publish" restriction

Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out

Umbraco CMS logout page displayed before session expiration