CVE-2025-25062

CVE-2025-25062 is an XSS vulnerability in Backdrop CMS (CKEditor 5 module) affecting 1.28.x prior to 1.28.5 and 1.29.x prior to 1.29.3. The issue arises from insufficient isolation of long text content, enabling crafted HTML/JS to execute when an administrator edits content. Exploitation prospect...

CVE-2024-54123

The CVE-2024-54123 entry affects Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2. The vulnerability is a cross-site scripting (XSS) flaw triggered when an SVG document is used and the SVG tag is allowed for a text format, enabling an attacker to inject script via SVG markup. Impact details in...

CVE-2025-25063

Backdrop CMS has an XSS vulnerability (CVE-2025-25063) in versions 1.28.x before 1.28.5 and 1.29.x before 1.29.3 due to insufficient validation of uploaded SVG images. Crafted SVGs could execute scripting when viewed directly via their URL, though sanitization occurs by embedding all uploaded SVG...