https-nj.gov---CVE-2019-11358

https-nj.gov---CVE-2019-11358 Rapporto di vulnerabilità del sito ufficiale del New Jersey jQuery prima della versione 3.4.0, come utilizzato in Drupal, Backdrop CMS e altri prodotti, gestisce erroneamente jQuery.extendtrue, , ... a causa della pollution di Object.prototype. Se un oggetto sorgente...

Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. id: CVE-2022-42096 info: name: Backdrop CMS version 1.23.0 - Cross Site Scripting Stored author: theamanrawat severity: medium description: | Backdrop CMS version 1.23.0 was...

CVE-2025-25062

CVE-2025-25062 Beschreibung Verwendung Beispiel Zeitleiste Beschreibung Im Backdrop CMS 1.29.2 besteht auf der Beitragsbearbeitungsseite eine Schwachstelle für gespeichertes Cross-Site-Scripting XSS. Dieses Skript verkettet die Schwachstelle mit einem CSRF-Payload, um eine Privilegienausweitung v...

CSRF-to-RCE-on-Backdrop-CMS

CSRF to RCE su Backdrop CMS 1.20 Questa PoC descrive come sfruttare CSRF su Backdrop CMS versione 1.20 con escalation a RCE. ID CVE CVE-2021-45268 Descrizione La versione 1.20 di Backdrop CMS consente di aggiungere plugin tramite file ZIP caricati sul sito. E poiché non dispone di protezione...

CVE-2022-42097

Backdrop CMS versione 1.23.0 Spiegazione della vulnerabilità: Backdrop CMS versione 1.23.0 è stato scoperto contenere una vulnerabilità di cross-site scripting XSS memorizzato tramite il campo Comment. Vettori d'attacco: L'attaccante deve pubblicare qualcosa nel campo "comment" e inserire il...

CVE-2022-42096

Backdrop CMS versione 1.23.0 Spiegazione della vulnerabilità: È stato scoperto che Backdrop CMS versione 1.23.0 contiene una vulnerabilità di cross-site scripting XSS memorizzato tramite il contenuto Post. Vettori d'attacco: L'attaccante deve pubblicare qualcosa sul "Post content" e inserire il...

CVE-2022-42095

Backdrop CMS Version 1.23.0 Erklärung der Schwachstelle: In Backdrop CMS Version 1.23.0 wurde eine gespeicherte Cross-Site-Scripting XSS-Schwachstelle über den Page-Inhalt entdeckt. Angriffsvektoren: Der Angreifer muss etwas im „Page content“ veröffentlichen und die XSS-Nutzlast in das Feld „Body...

CVE-2022-42094

Backdrop CMS Version 1.23.0 Erklärung der Sicherheitslücke: Backdrop CMS Version 1.23.0 wurde festgestellt, dass es eine gespeicherte Cross-Site-Scripting XSS-Sicherheitslücke über den Card-Inhalt enthält. Angriffsvektoren: Der Angreifer muss etwas auf dem „Card content“ posten und die XSS-Nutzla...

CVE-2022-42092

CVE-2022-42092 Exploit Python 🔥 Descrizione Questo script di exploit Python sfrutta un caricamento di file senza restrizioni in Backdrop CMS per ottenere un'esecuzione remota di codice RCE. ⚠️ Versioni Affette Versione 1.22.0 e versioni precedenti Nota: Backdrop CMS contesta ciò e sostiene che...

PYSEC-2026-628 XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2026-45430

The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The CVE 2025-71310 affects the GDPR cookies module for Backdrop CMS (before 1.x-1.3.5). The vulnerability is an XSS risk triggered when a malicious value is supplied in the optional YouTube service’s Info content field, under the condition that an attacker has either the "Create a GDPR Cookies Se...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

EUVD-2025-209927

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...