umbraco vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-117553 Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuthHigh 7.7 · Oct 27, 2026
• CVE-2026-69197 Umbraco is an ASP.NET CMS.High 8.7 · Sep 17, 2026
• CVE-2026-31834 Umbraco is an ASP.NET CMS.High 7.2 · Mar 10, 2026
• CVE-2026-27449 Umbraco Engage is a business intelligence platform.High 7.5 · Feb 26, 2026
• CVE-2025-68924 In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.High 7.5 · Jan 16, 2026
• CVE-2025-67288 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.Critical 10 · Dec 22, 2025
• CVE-2012-10054 Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScCritical 9.3 · Aug 13, 2025
• CVE-2025-32017 Umbraco is a free and open source .NET content management system.High 8.8 · Apr 8, 2025
• CVE-2023-49089 Umbraco is an ASP.NET content management system (CMS).High 7.7 · Dec 12, 2023
• CVE-2023-37267 Umbraco is a ASP.NET CMS.High 7.5 · Jul 13, 2023
• CVE-2019-25137 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/XHigh 7.2 · May 18, 2023
• CVE-2021-33224 File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.Critical 9.8 · Feb 24, 2023
• CVE-2022-22690 Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL High 8.6 · Jan 18, 2022
• CVE-2021-37334 Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitCritical 9.8 · Aug 25, 2021
• CVE-2020-9471 Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.High 8.8 · Mar 16, 2020
• CVE-2019-13957 In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter.Critical 9.8 · Oct 2, 2019
• CVE-2014-10074 Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .phCritical 9.8 · Aug 27, 2018
• CVE-2012-1301 The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter.Critical 9.8 · Apr 13, 2017
• CVE-2015-8814 Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by eHigh 8.8 · Mar 3, 2017
• CVE-2015-8813 The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct serverHigh 8.2 · Mar 3, 2017
• CVE-2013-4793 The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authenticaHigh 7.5 · Dec 27, 2014