CVE-2022-42092

CVE-2022-42092 Python Exploit 🔥 Description This Python exploit script targets an unrestricted file upload in Backdrop CMS to achieve a Remote Code Execution RCE. ⚠️ Affected Versions Version 1.22.0 and prior version Note: Backdrop CMS disputes this and argues that advanced permissions are...

CVE-2022-42095

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Page content. Attack Vectors: The attacker must post something on the "Page content" and insert the XSS payload at the "Body" input,...

CVE-2022-42094

Backdrop CMS 版本 1.23.0 漏洞说明： 已发现 Backdrop CMS 版本 1.23.0 通过 Card 内容包含一个存储型跨站脚本（XSS）漏洞。 攻击向量： 攻击者必须在“Card content”上发布内容，并将 XSS 载荷插入“Body”输入字段，同时选择 Raw HTML 编辑器，从而利用该存储型 XSS。保存后，XSS 载荷将立即触发。 受影响： http://ipaddress/backdrop/node/add/card POST /backdrop/node/add/card 载荷： 测试环境： 1. Backdrop CMS 版本 1.23.0...

CVE-2022-42096

Backdrop CMS 版本 1.23.0 漏洞说明： Backdrop CMS 版本 1.23.0 被发现包含一个存储型跨站脚本（XSS）漏洞，可通过 Post 内容触发。 攻击向量： 攻击者必须在“Post content”上发布内容，在“Body”输入框中插入 XSS 载荷，并选择 Raw HTML 编辑器以利用存储型 XSS。保存后，XSS 载荷将立即触发。 受影响范围： http://ipaddress/backdrop/node/add/post POST /backdrop/node/add/post 载荷： 测试环境： 1. Backdrop CMS 版本 1.23.0...

https-nj.gov---CVE-2019-11358

https-nj.gov---CVE-2019-11358 Vulnearability Report of the New Jersey official site jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto...

Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. id: CVE-2022-42096 info: name: Backdrop CMS version 1.23.0 - Cross Site Scripting Stored author: theamanrawat severity: medium description: | Backdrop CMS version 1.23.0 was...

CVE-2022-42097

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Comment . Attack Vectors: The attacker must post something on the "comment" and insert the XSS payload at the "comment" input, and...

CVE-2025-25062

CVE-2025-25062 描述 使用方法 示例 时间线 描述 在 Backdrop CMS 1.29.2 的帖子编辑页面中存在一个存储型跨站脚本 XSS 漏洞。该脚本将此漏洞与 CSRF 载荷相结合，实现从“编辑者”角色到“管理员”角色的权限提升。 相关链接： https://vulners.com/cve/CVE-2025-25062 https://backdropcms.org/security/backdrop-sa-core-2025-001 使用方法 root@kitploit: usage: CVE-2025-25062.py -h -u BACKDROPURL...

CSRF-to-RCE-on-Backdrop-CMS

Backdrop CMS 1.20 上的 CSRF 到 RCE 本 PoC 演示了如何利用 Backdrop CMS 1.20 版中的 CSRF 漏洞，并将其升级为 RCE（远程代码执行）。 CVE 编号 CVE-2021-45268 描述 Backdrop CMS 1.20 版本允许通过上传到站点的 ZIP 文件添加插件。由于它没有 CSRF 防护，攻击者可以创建一个包含允许执行命令的文件的插件，将其托管，并利用伪造页面，使站点管理员仅通过点击恶意链接即可上传该插件。 攻击场景 我们使用 GitHub 项目页面上提供的默认插件，在其中插入一个名为 shell.php...

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

PYSEC-2026-628 XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2026-45430

The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The CVE 2025-71310 affects the GDPR cookies module for Backdrop CMS (before 1.x-1.3.5). The vulnerability is an XSS risk triggered when a malicious value is supplied in the optional YouTube service’s Info content field, under the condition that an attacker has either the "Create a GDPR Cookies Se...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

CVE-2025-71310

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...

EUVD-2025-209927

The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...