backdropcms

Records35All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

backdropcms records in CISA KEV

No backdropcms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Backdrop Cms 16 records MEDIUM Backdrop 7 records HIGH Backdrop Core 1 record LOW Basic Cart 1 record LOW

Records

16 records in Backdrop Cms · all components

TI-2025-39465 CVE-2025-63828 · GHSA-ffpg-gm3h-4p5p

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate…

MEDIUM 60

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie i…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00229 Published 2025-11-18 No fix listed CWE-601

TI-2023-14781 CVE-2023-31045 · GHSA-3862-c622-v4fp

A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS…

MEDIUM 55

A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00531 Published 2023-04-24 Fixed in 1.24.2 CWE-79

TI-2022-20386 CVE-2022-42096 · GHSA-g8jw-8vpv-pv5q

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 55

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.02214 Published 2022-11-21 No fix listed CWE-79

TI-2022-20385 CVE-2022-42095 · GHSA-58rj-w2qf-qjg7

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 55

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.022 Published 2022-11-23 No fix listed CWE-79

TI-2025-18731 CVE-2025-25062 · GHSA-vrh8-g8q9-jhc6

Cross-site scripting in backdropcms backdrop

MEDIUM 54

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.01721 Published 2025-02-03 Fixed in 1.28.5, 1.29.3 CWE-79

TI-2019-10981 CVE-2019-14771 · GHSA-vcm5-8725-vff8

Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of…

MEDIUM 47

Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02601 Published 2019-08-08 No fix listed CWE-20

TI-2022-20383 CVE-2022-42092 · GHSA-33c9-rppf-m7fq

Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows…

LOW 36

Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02093 Published 2022-10-07 No fix listed CWE-434

TI-2019-14350 CVE-2019-19902 · GHSA-h8jv-w343-48r6

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

LOW 35

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01499 Published 2019-12-19 No fix listed CWE-20

TI-2025-28597 CVE-2025-44141 · GHSA-674q-gxgr-8jhg

A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.

LOW 27

A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00215 Published 2025-06-26 No fix listed CWE-79

TI-2024-36239 CVE-2024-54123 · GHSA-6gqq-xj74-45f9

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if…

LOW 27

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00309 Published 2024-11-29 No fix listed CWE-79

TI-2022-15396 CVE-2022-34530 · GHSA-r4cx-cqjr-vfr8

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows…

LOW 25

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00635 Published 2022-08-01 No fix listed CWE-640

TI-2019-14351 CVE-2019-19903 · GHSA-pjx6-j435-vcmj

An issue was discovered in Backdrop CMS 1.14.x before 1.14.2.

LOW 23

An issue was discovered in Backdrop CMS 1.14.x before 1.14.2.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00552 Published 2019-12-19 No fix listed CWE-79

TI-2019-14349 CVE-2019-19901 · GHSA-86wq-h57h-6m7w

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

LOW 23

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00552 Published 2019-12-19 No fix listed CWE-79

TI-2019-14348 CVE-2019-19900 · GHSA-mrg6-qrwx-6268

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

LOW 23

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00552 Published 2019-12-19 No fix listed CWE-79

TI-2018-16037 CVE-2018-1000813 · GHSA-8wm7-hhmh-8mwj

Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS)…

LOW 23

Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00741 Published 2018-12-20 No fix listed CWE-79

TI-2025-18732 CVE-2025-25063 · GHSA-cfr9-prm9-crgr

Cross-site scripting in backdropcms backdrop

LOW 20

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.002 Published 2025-02-03 Fixed in 1.28.5, 1.29.3 CWE-79

Open these records in search →