Umbraco

This hub aggregates every CVE we track for Umbraco, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 6 most recently published vulnerabilities affecting Umbraco.

• CVE-2021-47776Umbraco v8.14.1 - 'baseUrl' SSRF5.3Jan 15, 2026
• CVE-2019-13957In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter.9.8Oct 2, 2019
• CVE-2018-17256Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The ...4.8Nov 27, 2018
• CVE-2015-8813The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks ...8.2Mar 3, 2017
• CVE-2015-8815Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to (1) the media page, (2) the devel...6.1Mar 3, 2017
• CVE-2015-8814Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in th...8.8Mar 3, 2017