Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41
Reset filtersUmbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Umbraco Backoffice API Allows Unauthorized Modification of Domain Data
Umbraco CMS has an arbitrary file upload vulnerability
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
Umbraco Delivery API allows for cached requests to be returned with an invalid API key
Umbraco CMS disclosure of configured password requirements
Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
XSS/HTML Injection Vulnerability in Umbraco Preview Badge
Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Umbraco CMS logout page displayed before session expiration
Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.