CVE-2026-31834

Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient...

CVE-2026-31834 Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient...

EUVD-2025-204737

Umbraco CMS has an arbitrary file upload vulnerability...

PT-2025-52674

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 16.3.3 Description An arbitrary file upload issue exists in Umbraco CMS version 16.3.3. Attackers can potentially execute arbitrary code by uploading a specially crafted PDF file. The supplier disputes responsibility, stati...

EUVD-2024-3159

Malicious code in bioql PyPI...

EUVD-2024-3039

Malicious code in bioql PyPI...

EUVD-2024-2935

Malicious code in bioql PyPI...

EUVD-2023-3134

Malicious code in bioql PyPI...

Umbraco CMS 安全漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS versions prior to 4.7.1, which stems from the presence of path traversal in the codeEditorSave.asmx endpoint, which could lead to remote code execution...

CVE-2024-48927

Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full...

CVE-2025-46736

CVE-2025-46736 affects the Umbraco CMS (a .NET-based open source content management system). The issue allows user enumeration by analyzing the timing of post-login API responses, enabling an attacker to determine if an account exists. Affected versions are prior to 10.8.10 and 13.8.1. The vulner...

CVE-2025-27602

Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folde...

CVE-2025-27602 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folde...

CVE-2025-27602 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folde...

CVE-2024-48926

Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. The Backoffice displays the logout page with a session timeout message before the server...

Umbraco CMS 授权问题漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. An authorization issue vulnerability exists in Umbraco CMS that stems from a server session not being fully terminated during an explicit logout...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to improper configuration of the SMTP settings combined with enabled password reset functionality. An attacker can enumerate user accounts by observing the behavior of the password reset feature. Remediation...

Umbraco 安全漏洞

Umbraco is an open source Content Management System CMS written in C by the Danish company Umbraco. A security vulnerability exists in Umbraco CMS version 7.12.4, which originates from a vulnerability that allows an authenticated administrator to execute remote code via msxsl:script in...

Umbraco-RCE

Umbraco RCE exploit / PoC Umbraco CMS 7.12.4 - Authenticat...