Backdrop (Backdropcms) - vulnerabilities (CVEs)
14 CVEs, 4 in the last 30 days, 143 known versions, newest CVE from 2026-10-16. Vendor: Backdropcms.
CVEs of Backdrop
- CVE-2026-111442 - CVSS 5.3 (medium), 2026-10-16: Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous…
- CVE-2026-110907 - CVSS 7.5 (high), 2026-10-15: Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name])…
- CVE-2026-107914 - CVSS 7.8 (high), 2026-10-09: Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This…
- CVE-2026-104476 - CVSS 8.2 (high), 2026-10-02: Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives…
- CVE-2025-25063 - CVSS 4.4 (medium), 2025-02-03: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure…
- CVE-2025-25062 - CVSS 4.4 (medium), 2025-02-03: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor…
- CVE-2024-41709 - CVSS 6.1 (medium), 2024-07-22: Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This…
- CVE-2023-31045 - CVSS 4.8 (medium), 2023-04-24: A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or…
- CVE-2022-42097 - CVSS 4.8 (medium), 2022-11-22: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
- CVE-2022-42094 - CVSS 4.8 (medium), 2022-11-22: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
- CVE-2022-24590 - CVSS 5.4 (medium), 2022-02-15: A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
- CVE-2021-45268 - CVSS 8.8 (high), 2022-02-03: A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the…
- CVE-2019-14769 - CVSS 6.1 (medium), 2019-08-08: Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators.…
- CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
