Vulnerabilities in Umbraco
52 resultsCVE-2025-27602MEDIUMUmbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized ContentEPSS 0.3%CVE-2026-31833MEDIUMUmbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute FilteringEPSS 0.3%CVE-2025-47280LOWUmbraco.Forms has HTML injection vulnerability in 'Send email' workflowEPSS 0.3%CVE-2024-35240MEDIUMStored Cross-site Scripting on Print Functionality in Umbraco CommerceEPSS 0.3%CVE-2025-24012MEDIUMUmbraco Backoffice Components Have XSS/HTML Injection VulnerabilityEPSS 0.3%CVE-2024-48929MEDIUMUmbraco CMS Has Incomplete Server Termination During Explicit Sign-OutEPSS 0.3%CVE-2024-48926MEDIUMUmbraco CMS logout page displayed before session expirationEPSS 0.3%CVE-2024-43377MEDIUMUmbraco CMS Improper Access Control vulnerabilityEPSS 0.2%CVE-2026-31832MEDIUMUmbraco Backoffice API Allows Unauthorized Modification of Domain DataEPSS 0.2%CVE-2025-48953MEDIUMUmbraco Vulnerable to By-Pass of Configured Allowed Extensions for File UploadsEPSS 0.2%CVE-2026-46616MEDIUMUmbraco.Cms: Open Redirect Vulnerability in Surface ControllersEPSS 0.2%CVE-2026-46609MEDIUMUmbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialogEPSS 0.1%