Umbraco Cms Security Vulnerabilities and Issues — Umbraco Cms CVE List

Lucene search

UmbracoUmbraco Cms

4 matches found

CVE•added 2022/01/18 5:15 p.m.•135 views

CVE-2022-22691

The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset toke...

7.4CVSS7AI score0.00411EPSS

CVE•added 2023/05/18 7:15 a.m.•110 views

CVE-2019-25137

Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.

7.2CVSS7.1AI score0.24612EPSS

CVE•added 2014/12/27 6:59 p.m.•41 views

CVE-2013-4793

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2023/12/12 7:15 p.m.•28 views

CVE-2023-49089

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 co...

7.7CVSS6.8AI score0.00122EPSS