339 matches found
CVE-2022-42092
CVE-2022-42092 Exploit Python 🔥 Description Ce script d'exploitation Python cible un téléchargement de fichier sans restriction dans Backdrop CMS pour exécuter du code à distance RCE. ⚠️ Versions affectées Version 1.22.0 et versions antérieures Remarque : Backdrop CMS conteste cette vulnérabilité...
Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. id: CVE-2022-42096 info: name: Backdrop CMS version 1.23.0 - Cross Site Scripting Stored author: theamanrawat severity: medium description: | Backdrop CMS version 1.23.0 was...
EUVD-2026-91852
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...
CVE-2026-104476
Backdrop CMS versions prior to 1.35.1 are susceptible to an information disclosure vulnerability. This flaw allows unauthenticated attackers to retrieve configuration export archives that remain on the server after a transfer is completed. By downloading these compressed archives, an attacker can...
CVE-2022-42096
Backdrop CMS version 1.23.0 Explication de la vulnérabilité : Backdrop CMS version 1.23.0 a été découvert comme contenant une vulnérabilité de cross-site scripting XSS stocké via le contenu Post. Vecteurs d'attaque : L'attaquant doit publier quelque chose sur le "Post content" et insérer la charg...
CVE-2022-42094
Backdrop CMS version 1.23.0 Explication de la vulnérabilité : Il a été découvert que Backdrop CMS version 1.23.0 contient une vulnérabilité de script intersite XSS stockée via le contenu Card. Vecteurs d'attaque : L'attaquant doit publier quelque chose sur le "Card content" et insérer la charge...
CVE-2022-42097
Backdrop CMS версия 1.23.0 Описание уязвимости: В Backdrop CMS версии 1.23.0 обнаружена уязвимость хранимого межсайтового скриптинга XSS через поле Comment . Векторы атаки: Атакующий должен опубликовать что-то в "comment" и вставить XSS-пейлоад в поле "comment", а также выбрать Raw HTML Editor,...
CVE-2025-25062
CVE-2025-25062 Описание Использование Пример Временная шкала Описание Уязвимость хранимого межсайтового скриптинга XSS существует на странице редактирования постов Backdrop CMS 1.29.2. Этот скрипт объединяет уязвимость с CSRF-полезной нагрузкой для повышения привилегий с роли 'Editor' до...
CSRF-to-RCE-on-Backdrop-CMS
От CSRF к RCE в Backdrop CMS 1.20 Этот PoC описывает, как эксплуатировать CSRF в Backdrop CMS версии 1.20 с эскалацией до RCE. CVE ID CVE-2021-45268 Описание Backdrop CMS версии 1.20 позволяет добавлять плагины через ZIP-файлы, загружаемые на сайт. И поскольку в нём отсутствует защита от CSRF,...
https-nj.gov---CVE-2019-11358
https-nj.gov---CVE-2019-11358 Rapport de vulnérabilité du site officiel du New Jersey jQuery avant 3.4.0, tel qu'utilisé dans Drupal, Backdrop CMS et d'autres produits, gère mal jQuery.extendtrue, , ... à cause d'une pollution de Object.prototype. Si un objet source non désinfecté contenait une...
CVE-2022-42095
Backdrop CMS version 1.23.0 Explication de la vulnérabilité : Backdrop CMS version 1.23.0 s'est avéré contenir une vulnérabilité de script intersite XSS stockée via le contenu Page. Vecteurs d'attaque : L'attaquant doit poster quelque chose dans le « contenu de la page » et insérer la charge util...
PYSEC-2026-628 XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...
CVE-2025-71310
The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...
CVE-2026-45430
The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks...
CVE-2025-71310
The CVE 2025-71310 affects the GDPR cookies module for Backdrop CMS (before 1.x-1.3.5). The vulnerability is an XSS risk triggered when a malicious value is supplied in the optional YouTube service’s Info content field, under the condition that an attacker has either the "Create a GDPR Cookies Se...
EUVD-2025-209927
The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...
CVE-2025-71310
The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...
Backdrop CMS 安全漏洞
Backdrop CMS is an open-source content management system developed by Backdrop CMS. Versions of Backdrop CMS prior to 1.x-1.3.5 contained security vulnerabilities. These vulnerabilities stemmed from insufficient protection against cross-site scripting attacks. If optional information fields in th...
CVE-2025-71310: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The GDPR cookies module for Backdrop CMS before 1.x-1.3.5 doesn't sufficiently protect visitors from Cross Site Scripting XSS if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with...