Priority MEDIUM 60
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie i…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00229 · Published 2025-11-18 · No fix listed CWE-601
Priority LOW 27
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00215 · Published 2025-06-26 · No fix listed CWE-79
Priority LOW 20
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.
CVSS 3.1MEDIUM 4.4· Network · Low privileges · User interaction · EPSS 0.002 · Published 2025-02-03 · Fixed in 1.28.5, 1.29.3 CWE-79
Priority MEDIUM 54
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.
CVSS 3.1MEDIUM 4.4· Network · Low privileges · User interaction · EPSS 0.01721 · Published 2025-02-03 · Fixed in 1.28.5, 1.29.3 CWE-79
Priority LOW 27
Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00309 · Published 2024-11-29 · No fix listed CWE-79
Priority MEDIUM 55
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00531 · Published 2023-04-24 · Fixed in 1.24.2 CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.022 · Published 2022-11-23 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.02214 · Published 2022-11-21 · No fix listed CWE-79
Priority LOW 36
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02093 · Published 2022-10-07 · No fix listed CWE-434
Priority LOW 25
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00635 · Published 2022-08-01 · No fix listed CWE-640
Priority LOW 23
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00552 · Published 2019-12-19 · No fix listed CWE-79
Priority LOW 35
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01499 · Published 2019-12-19 · No fix listed CWE-20
Priority LOW 23
An issue was discovered in Backdrop CMS 1.14.x before 1.14.2.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00552 · Published 2019-12-19 · No fix listed CWE-79
Priority LOW 23
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00552 · Published 2019-12-19 · No fix listed CWE-79
Priority MEDIUM 47
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02601 · Published 2019-08-08 · No fix listed CWE-20
Priority LOW 23
Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00741 · Published 2018-12-20 · No fix listed CWE-79
THREATIST.IORead the docs