—0.0NuGet
GHSA-335x-5wcm-8jv2· CVE-2023-48227Backoffice User can bypass "Publish" restriction
Modified: 9/10/2026
package
NuGet/Umbraco.CMS
pkg:nuget/Umbraco.CMS
—0.0NuGet
GHSA-4gp9-ff99-j6vj· CVE-2024-48925Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
Modified: 10/22/2024
HIGH8.8NuGet
GHSA-5f6p-4hxq-rjxm· CVE-2015-8814Umbraco CMS vulnerable to CSRF
Modified: 11/8/2023
—0.0NuGet
GHSA-6324-52pr-h4p5· CVE-2023-49089Using the directory back payload (“/../”) in a package name allows placement of package in other folders.
Modified: 9/10/2026
—0.0NuGet
GHSA-6xmx-85x3-4cv2· CVE-2023-49279Stored XSS via SVG File Upload
Modified: 9/10/2026
—0.0NuGet
GHSA-7x74-h8cw-qhxq· CVE-2023-49278Brute force exploit can be used to collect valid usernames
Modified: 9/10/2026
LOW3.7NuGet
GHSA-8qp8-9rpw-j46c· CVE-2023-49274SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.
Modified: 2/16/2024
MEDIUM5.4NuGet
GHSA-cfr5-7p54-4qg8· CVE-2023-49273Privilege Escalation using Spoofing
Modified: 2/16/2024
MEDIUM4.2NuGet
GHSA-fp6q-gccw-7qqm· CVE-2024-48926Umbraco CMS logout page displayed before session expiration
Modified: 10/22/2024
MEDIUM4.3NuGet
GHSA-v98m-398x-269r· CVE-2023-48313DOM-XSS on Backoffice login screen.
Modified: 9/10/2026
MEDIUM4.2NuGet
GHSA-wxw9-6pv9-c3xc· CVE-2024-48929Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Modified: 10/22/2024
HIGH8.2NuGet
GHSA-x34j-wxq8-7vcm· CVE-2015-8813Umbraco CMS vulnerable to CSRF
Modified: 11/8/2023
—0.0NuGet
GHSA-xxc6-35r7-796w· CVE-2023-38694Possible injection of HTML into user invite mails
Modified: 2/16/2024