# Umbraco Umbraco Cms


- [CVE-2025-67288](https://insights.sbomify.com/CVE-2025-67288/): Umbraco CMS has an arbitrary file upload vulnerability (critical 10.0)
- [CVE-2014-10074](https://insights.sbomify.com/CVE-2014-10074/): File upload in n/a (critical 9.8)
- [CVE-2012-1301](https://insights.sbomify.com/CVE-2012-1301/): Server-side request forgery in n/a (critical 9.8)
- [CVE-2012-10054](https://insights.sbomify.com/CVE-2012-10054/): Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE (critical 9.3)
- [CVE-2025-32017](https://insights.sbomify.com/CVE-2025-32017/): Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users (high 8.8)
- [CVE-2020-9471](https://insights.sbomify.com/CVE-2020-9471/): Umbraco CMS Authenticated File Upload (high 8.8)
- [CVE-2022-22690](https://insights.sbomify.com/CVE-2022-22690/): Umbraco Remote ApplicationURL Overwrite (high 8.6)
- [CVE-2023-49089](https://insights.sbomify.com/CVE-2023-49089/): Umbraco CMS possible path traversal when creating packages from backoffice (high 7.7)
- [CVE-2023-37267](https://insights.sbomify.com/CVE-2023-37267/): Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions (high 7.5)
- [CVE-2013-4793](https://insights.sbomify.com/CVE-2013-4793/): Auth bypass in n/a (high 7.5)
- [CVE-2026-31834](https://insights.sbomify.com/CVE-2026-31834/): Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks (high 7.2)
- [CVE-2019-25137](https://insights.sbomify.com/CVE-2019-25137/): Code injection in n/a (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/products/umbraco/umbraco-cms/