Priority HIGH 69
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.8682 · Published 2019-04-19 · Partial fix · 3.4.0, 4.3.4 +3 CWE-1321
Priority MEDIUM 60
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie i…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00229 · Published 2025-11-18 · No fix listed CWE-601
Priority MEDIUM 55
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00531 · Published 2023-04-24 · Fixed in 1.24.2 CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00857 · Published 2022-11-22 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.02214 · Published 2022-11-21 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.022 · Published 2022-11-23 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0283 · Published 2022-11-22 · No fix listed CWE-79
Priority MEDIUM 54
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.
CVSS 3.1MEDIUM 4.4· Network · Low privileges · User interaction · EPSS 0.01721 · Published 2025-02-03 · Fixed in 1.28.5, 1.29.3 CWE-79
Priority MEDIUM 47
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02601 · Published 2019-08-08 · No fix listed CWE-20
Priority MEDIUM 42
A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PH…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01821 · Published 2022-02-03 · No fix listed CWE-352
Priority LOW 39
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00335 · Published 2026-10-15 · Fixed in 1.35.2, 1.34.6 CWE-669
Priority LOW 36
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02093 · Published 2022-10-07 · No fix listed CWE-434
Priority LOW 35
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive.
CVSS 3.1HIGH 7.8· Local · No auth · No interaction · EPSS 0.0012 · Published 2026-10-09 · Fixed in 1.34.5, 1.35.1 CWE-459
Priority LOW 35
An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00297 · Published 2025-03-07 · Fixed in 1.x-1.0.1 CWE-863
Priority LOW 35
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01499 · Published 2019-12-19 · No fix listed CWE-20
Priority LOW 29
In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00793 · Published 2019-08-08 · No fix listed CWE-79
Priority LOW 29
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00846 · Published 2019-08-08 · No fix listed CWE-79
Priority LOW 28
An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00245 · Published 2025-04-25 · Fixed in 1.x-3.6.2 CWE-79
Priority LOW 28
An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.4.5 CWE-79
Priority LOW 28
An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.0.3 CWE-79
Priority LOW 28
An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.1.1 CWE-79
Priority LOW 28
An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.0.5 CWE-79
Priority LOW 28
A vulnerability was found in backdrop-contrib Basic Cart on Drupal.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00547 · Published 2023-01-11 · No fix listed CWE-79
Priority LOW 27
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00215 · Published 2025-06-26 · No fix listed CWE-79
Priority LOW 27
Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00309 · Published 2024-11-29 · No fix listed CWE-79
Load more
THREATIST.IORead the docs