Priority LOW 24
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00234 · Published 2026-10-16 · Fixed in 1.35.2, 1.34.6 CWE-79
Priority LOW 39
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00335 · Published 2026-10-15 · Fixed in 1.35.2, 1.34.6 CWE-669
Priority LOW 35
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive.
CVSS 3.1HIGH 7.8· Local · No auth · No interaction · EPSS 0.0012 · Published 2026-10-09 · Fixed in 1.34.5, 1.35.1 CWE-459
Priority LOW 10
The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTu…
CVSS 4.0LOW 1.8· Network · High privileges · User interaction · EPSS 0.00264 · Published 2026-05-26 · Fixed in 1.x-1.3.5 CWE-80
Priority MEDIUM 60
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie i…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00229 · Published 2025-11-18 · No fix listed CWE-601
Priority LOW 27
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00215 · Published 2025-06-26 · No fix listed CWE-79
Priority LOW 28
An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00245 · Published 2025-04-25 · Fixed in 1.x-3.6.2 CWE-79
Priority LOW 28
An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.4.5 CWE-79
Priority LOW 28
An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.0.3 CWE-79
Priority LOW 28
An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.1.1 CWE-79
Priority LOW 28
An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2025-03-07 · Fixed in 1.x-1.0.5 CWE-79
Priority LOW 35
An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00297 · Published 2025-03-07 · Fixed in 1.x-1.0.1 CWE-863
Priority LOW 20
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.
CVSS 3.1MEDIUM 4.4· Network · Low privileges · User interaction · EPSS 0.002 · Published 2025-02-03 · Fixed in 1.28.5, 1.29.3 CWE-79
Priority MEDIUM 54
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.
CVSS 3.1MEDIUM 4.4· Network · Low privileges · User interaction · EPSS 0.01721 · Published 2025-02-03 · Fixed in 1.28.5, 1.29.3 CWE-79
Priority LOW 27
Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00309 · Published 2024-11-29 · No fix listed CWE-79
Priority LOW 27
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00315 · Published 2024-07-22 · Fixed in 1.27.3, 1.28.2 CWE-79
Priority MEDIUM 55
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00531 · Published 2023-04-24 · Fixed in 1.24.2 CWE-79
Priority LOW 28
A vulnerability was found in backdrop-contrib Basic Cart on Drupal.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00547 · Published 2023-01-11 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.022 · Published 2022-11-23 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00857 · Published 2022-11-22 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0283 · Published 2022-11-22 · No fix listed CWE-79
Priority MEDIUM 55
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.02214 · Published 2022-11-21 · No fix listed CWE-79
Priority LOW 36
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02093 · Published 2022-10-07 · No fix listed CWE-434
Priority LOW 25
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00635 · Published 2022-08-01 · No fix listed CWE-640
Priority LOW 25
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00624 · Published 2022-02-15 · No fix listed CWE-79
Load more
THREATIST.IORead the docs