CVE-2019-25137-Version-Research

CVE-2019-25137 Affected Version Research CVE-2019-25137 Overview CVE-2019-25137 is a XSLT injection vulnerability in Umbraco CMS. The vulnerability is present in the XSLT Extensive Stylesheet Language Transformations Visualizer webpage. The vulnerable URI for this webpage is...

Umbraco <7.4.0- Server-Side Request Forgery

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index. id: CVE-2015-8813 info: name: Umbraco 7.4.0- Server-Side Request...

CVE-2019-25137-RCE

CVE-2019-25137-RCE CVE-2019-25137 is an Umbraco RCE vulnerability, the script within this repo is slightly altered This exploit script is based on script by Alexandre ZANNI EDB-ID 49488. It is slightly altered, changed the flow to skip token extraction before login, performed the login first...

Umbraco-RCE

Umbraco RCE exploit / PoC Umbraco CMS 7.12.4 - Authenticated Remote Code Execution EDB-49488 PacketStorm WLB-2020080012 Usage $ python exploit.py -h usage: exploit.py -h -u USER -p PASS -i URL -c CMD -a ARGS Umbraco authenticated RCE optional arguments: -h, --help show this help message and exit ...

CVE-2025-24011-PoC

Proof of concept for CVE-2025-24011 based on https://github.com/advisories/GHSA-hmg4-wwm5-p999 This toool has been tested on Umbraco version 15.1.1 and 13.7.2 on Ubuntu 24.04.2 LTS Usernames in Umbraco are as I understand it e-mails. This tools accepts a list of "usernames" -f and a url -u eg...

CVE-2026-111624

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

CVE-2026-111624

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

CVE-2026-111624

Umbraco CMS versions before 17.7.1 and 18.2.1 are affected by a missing authorization vulnerability in the PreviewHub and BackofficeHub SignalR hubs. Due to this flaw, unauthenticated clients can connect to these hubs and complete the SignalR negotiate step. This allows attackers to receive refre...

CVE-2026-111624 Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

CVE-2026-111624 Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

EUVD-2026-103046

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

CVE-2026-111624: Missing Authentication for Critical Function

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

PT-2026-116023

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

GHSA-WR57-HQMP-FGVH Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public unprotected node references a protected node through a Content Picker or Multi-Node Tree Picker including those nested inside Block List,...

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public unprotected node references a protected node through a Content Picker or Multi-Node Tree Picker including those nested inside Block List,...

CVE-2026-69197

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

EUVD-2026-81902

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

CVE-2026-69197

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...