Backdropcms vulnerabilities

35 vulnerabilities

Known vulnerabilities in Backdropcms products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.

Products

11
RoutineCVE-2026-111442backdropcms · backdropbackdropcms backdropBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.CVSS5.3MediumEPSS0.23%PrioritiseCVE-2026-110907backdropcms · backdropbackdropcms backdropBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.CVSS7.5HighEPSS0.34%RoutineCVE-2026-107914backdropcms · backdropbackdropcms backdropBackdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.CVSS7.8HighEPSS0.12%RoutineCVE-2025-71310backdropcms · gdpr cookies module for backdrop cmsbackdropcms gdpr cookies module for backdrop cmsThe GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.CVSS1.8LowEPSS0.26%RoutineCVE-2025-63828backdropcms · backdrop_cmsbackdropcms backdrop_cmsHost Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.CVSS6.1MediumEPSS0.23%RoutineCVE-2025-44141backdropcms · backdrop_cmsbackdropcms backdrop_cmsA Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.CVSS6.1MediumEPSS0.21%RoutineCVE-2025-46595backdropcms · flagbackdropcms flagAn XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and any other type of entity. It doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow crafted HTML to result in Cross Site Scripting. This is mitigated by the fact that an attacker must have a role with permission to create links on the website, for example: create or edit comments or content with a filtered text format.CVSS6.4MediumEPSS0.24%RoutineCVE-2025-27826backdropcms · bootstrap lite themebackdropcms bootstrap lite themeAn XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.CVSS6.4MediumEPSS0.24%RoutineCVE-2025-27825backdropcms · bootstrap 5 lite themebackdropcms bootstrap 5 lite themeAn XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.CVSS6.4MediumEPSS0.24%RoutineCVE-2025-27824backdropcms · link iframe formatterbackdropcms link iframe formatterAn XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an iFrame field.CVSS6.4MediumEPSS0.24%RoutineCVE-2025-27823backdropcms · mail disguisebackdropcms mail disguiseAn issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent spambots from collecting them. The module doesn't sufficiently validate the data attribute value on links, potentially leading to a Cross Site Scripting (XSS) vulnerability. This is mitigated by the fact an attacker must be able to insert link (<a>) HTML elements containing data attributes into the page.CVSS6.4MediumEPSS0.24%RoutineCVE-2025-27822backdropcms · masqueradebackdropcms masqueradeAn issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module provides a "Masquerade as admin" permission to restrict people (who can masquerade) from switching to an account with administrative privileges. This permission is not always honored and may allow non-administrative users to masquerade as an administrator. This vulnerability is mitigated by the fact that an attacker must have a role with the "Masquerade as user" permission.CVSS7.5HighEPSS0.30%RoutineCVE-2025-25063backdropcms · backdrop +1 morebackdropcms backdropAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within &lt;img&gt; tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.CVSS4.4MediumEPSS0.20%RoutineCVE-2025-25062backdropcms · backdrop +1 morebackdropcms backdropAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.CVSS4.4MediumEPSS1.72%RoutineCVE-2024-54123backdropcms · backdrop_cmsbackdropcms backdrop_cmsBackdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.CVSS6.1MediumEPSS0.29%RoutineCVE-2024-41709backdropcms · backdropbackdropcms backdropBackdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.CVSS6.1MediumEPSS0.32%RoutineCVE-2023-31045backdropcms · backdrop_cmsbackdropcms backdrop_cmsA stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."CVSS4.8MediumEPSS0.53%RoutineCVE-2012-10004backdrop-contrib · basic cart +1 morebackdrop-contrib Basic Cart basic_cart.cart.inc basic_cart_checkout_form_submit cross site scriptingA vulnerability was found in backdrop-contrib Basic Cart on Drupal. It has been classified as problematic. Affected is the function basic_cart_checkout_form_submit of the file basic_cart.cart.inc. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.x-1.1.1 is able to address this issue. The patch is identified as a10424ccd4b3b4b433cf33b73c1ad608b11890b4. It is recommended to upgrade the affected component. VDB-217950 is the identifier assigned to this vulnerability.CVSS6.1MediumEPSS0.55%RoutineCVE-2022-42095backdropcms · backdrop_cmsbackdropcms backdrop_cmsBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.CVSS4.8MediumEPSS2.20%RoutineCVE-2022-42097backdropcms · backdropbackdropcms backdropBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .CVSS4.8MediumEPSS0.86%