backdropcms

Records35All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

backdropcms records in CISA KEV

No backdropcms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Backdrop Cms 16 records MEDIUM Backdrop 7 records HIGH Backdrop Core 1 record LOW Basic Cart 1 record LOW

Records

7 records in Backdrop · all components

TI-2019-08480 CVE-2019-11358 · GHSA-6c3j-c64m-qhgq

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles…

HIGH 69

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.8682 Published 2019-04-19 Partial fix · 3.4.0, 4.3.4 +3 CWE-1321

TI-2022-20387 CVE-2022-42097 · GHSA-g9cp-9fw3-56cf

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .

MEDIUM 55

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00857 Published 2022-11-22 No fix listed CWE-79

TI-2022-20384 CVE-2022-42094 · GHSA-vcvg-g8p2-3hqr

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 55

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0283 Published 2022-11-22 No fix listed CWE-79

TI-2021-20467 CVE-2021-45268 · GHSA-cxfw-78g3-3grg

A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which…

MEDIUM 42

A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PH…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01821 Published 2022-02-03 No fix listed CWE-352

TI-2019-10979 CVE-2019-14769 · GHSA-48qf-j39f-v99r

Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter…

LOW 29

Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00846 Published 2019-08-08 No fix listed CWE-79

TI-2024-27769 CVE-2024-41709 · GHSA-3wmx-48g3-x66g

Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field…

LOW 27

Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00315 Published 2024-07-22 Fixed in 1.27.3, 1.28.2 CWE-79

TI-2022-08438 CVE-2022-24590 · GHSA-3q8r-fqc6-3cxq

A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS…

LOW 25

A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2022-02-15 No fix listed CWE-79

Open these records in search →