Umbraco CMS any version

Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.

Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

Umbraco Remote ApplicationURL Overwrite

Umbraco CMS possible path traversal when creating packages from backoffice

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

Umbraco Password Reset URL Poison

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.

Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.

Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API

Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx.

Umbraco contains a DOM-XSS

Open Redirect Bypass Protection

Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload.

Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs.

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.

Umbraco CMS vulnerable to possible injection of HTML in an unintended form

Umbraco CMS vulnerable to stored XSS via SVG File Upload

Umbraco CMS vulnerable to Privilege Escalation using Spoofing

Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

Umbraco CMS Improper Access Control vulnerability

Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes

Umbraco CMS brute force exploit can be used to collect valid usernames

Umbraco CMS SMTP misconfiguration exposes potential registered user email

Umbraco possible user enumeration vulnerability

Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

Umbraco's Delivery API allows for cached requests to be returned with an invalid API key

Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality