Backdropcms Backdrop_cms
16 CVEs affecting Backdropcms Backdrop_cms. Latest disclosed: 2025-11-18. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14771 | Critical | 9.8 | 2019-08-08 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line… |
CVE-2022-42092 | High | 7.2 | 2022-10-07 | Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this an… |
CVE-2019-19902 | High | 7.2 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the u… |
CVE-2025-63828 | Medium | 6.1 | 2025-11-18 | Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to m… |
CVE-2025-44141 | Medium | 6.1 | 2025-06-26 | A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. |
CVE-2024-54123 | Medium | 6.1 | 2024-11-29 | Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format. |
CVE-2022-34530 | Medium | 5.3 | 2022-08-01 | An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct… |
CVE-2023-31045 | Medium | 4.8 | 2023-04-24 | A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or H… |
CVE-2022-42095 | Medium | 4.8 | 2022-11-23 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content. |
CVE-2022-42096 | Medium | 4.8 | 2022-11-21 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content. |
CVE-2019-19903 | Medium | 4.8 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administr… |
CVE-2019-19901 | Medium | 4.8 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block desc… |
CVE-2019-19900 | Medium | 4.8 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names… |
CVE-2018-1000813 | Medium | 4.8 | 2018-12-20 | Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. t… |
CVE-2025-25063 | Medium | 4.4 | 2025-02-03 | An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they… |
CVE-2025-25062 | Medium | 4.4 | 2025-02-03 | An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor… |