CVE-2022-42097

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Comment . Attack Vectors: The attacker must post something on the "comment" and insert the XSS payload at the "comment" input, and...

CVE-2022-42096

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Post content. Attack Vectors: The attacker must post something on the "Post content" and insert the XSS payload at the "Body" input,...

Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. id: CVE-2022-42096 info: name: Backdrop CMS version 1.23.0 - Cross Site Scripting Stored author: theamanrawat severity: medium description: | Backdrop CMS version 1.23.0 was...

CVE-2022-42092

CVE-2022-42092 Python Exploit 🔥 Description This Python exploit script targets an unrestricted file upload in Backdrop CMS to achieve a Remote Code Execution RCE. ⚠️ Affected Versions Version 1.22.0 and prior version Note: Backdrop CMS disputes this and argues that advanced permissions are...

https-nj.gov---CVE-2019-11358

https-nj.gov---CVE-2019-11358 Vulnearability Report of the New Jersey official site jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto...

CVE-2022-42094

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Card content. Attack Vectors: The attacker must post something on the "Card content" and insert the XSS payload at the "Body" input,...

CVE-2025-25062

CVE-2025-25062 Description Usage Example Timeline Description A Stored Cross-Site-Scripting XSS vulnerability exists in the Backdrop CMS 1.29.2 post edit page. This script chains the vulnerability with a CSRF payload to achieve privilege escalation from the role of 'Editor' to 'Administrator'...

CVE-2022-42095

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Page content. Attack Vectors: The attacker must post something on the "Page content" and insert the XSS payload at the "Body" input,...

CSRF-to-RCE-on-Backdrop-CMS

Backdrop CMS 1.20 上的 CSRF 到 RCE 本 PoC 演示了如何利用 Backdrop CMS 1.20 版中的 CSRF 漏洞，并将其升级为 RCE（远程代码执行）。 CVE 编号 CVE-2021-45268 描述 Backdrop CMS 1.20 版本允许通过上传到站点的 ZIP 文件添加插件。由于它没有 CSRF 防护，攻击者可以创建一个包含允许执行命令的文件的插件，将其托管，并利用伪造页面，使站点管理员仅通过点击恶意链接即可上传该插件。 攻击场景 我们使用 GitHub 项目页面上提供的默认插件，在其中插入一个名为 shell.php...

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

PYSEC-2026-628 XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2026-45430

The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The CVE 2025-71310 affects the GDPR cookies module for Backdrop CMS (before 1.x-1.3.5). The vulnerability is an XSS risk triggered when a malicious value is supplied in the optional YouTube service’s Info content field, under the condition that an attacker has either the "Create a GDPR Cookies Se...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

EUVD-2025-209927

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...