umbraco-cms @umbraco-cms/backoffice vulnerabilities

Latest umbraco-cms @umbraco-cms/backoffice CVEs

Newest publication first

1. CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

   Published 2025-01-21

   Medium·CVSS 5.4 EPSS 0.27%

   Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2...

2. CVE-2024-47819 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

   Published 2024-10-22

   High·CVSS 8.7 EPSS 0.35%

   Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.