Please report any vulnerabilities to security@umbraco.dk
Read more about Umbraco's security policies.
You can expect to hear back from us within 48 hours.
Security: umbraco/Umbraco-CMS
Security
.github/SECURITY.md
-
Possible user enumerationGHSA-552f-97wf-pmpq published
Mar 20, 2024 by bergmaniaLow -
Webhook logs viewable without Umbraco is in Debug modeGHSA-74p6-39f2-23v3 published
Apr 17, 2024 by netcamoModerate -
Privilege Escalation using SpoofingGHSA-cfr5-7p54-4qg8 published
Dec 12, 2023 by bergmaniaModerate -
SMTP misconfiguration leading to potential registered user email.GHSA-8qp8-9rpw-j46c published
Dec 12, 2023 by bergmaniaLow -
DOM-based stored cross-site scriptingGHSA-v98m-398x-269r published
Dec 12, 2023 by bergmaniaModerate -
Backoffice User can bypass "Publish" restrictionGHSA-335x-5wcm-8jv2 published
Dec 12, 2023 by bergmaniaLow -
Possible Path traversal when creating packages from backofficeGHSA-6324-52pr-h4p5 published
Dec 12, 2023 by bergmaniaLow -
Brute force exploit can be used to collect valid usernamesGHSA-7x74-h8cw-qhxq published
Dec 12, 2023 by bergmaniaLow -
Stored XSS via SVG File UploadGHSA-6xmx-85x3-4cv2 published
Dec 12, 2023 by bergmaniaLow -
Possible injection of HTML in a unintended formGHSA-xxc6-35r7-796w published
Dec 12, 2023 by bergmaniaLow
Learn more about advisories related to umbraco/Umbraco-CMS in the GitHub Advisory Database