CVE-2022-42096

Backdrop CMS 1.23.0 contains a stored XSS in Post content. Exploitation requires authenticated content-creation/administrative privileges (per sources). An attacker can inject malicious JavaScript that may be executed when posts are viewed, potentially compromising administrator sessions. Remedia...

CVE-2019-19900

Summary: Backdrop CMS is affected by a reflected/stored-XSS issue in the content-creation interface due to insufficient filtering of content type names. Affected versions are Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. An attacker must have a role with the “Administer content type...

CVE-2019-19903

Backdrop CMS 1.14.x before 1.14.2 is affected by an XSS in file type descriptions due to insufficient output filtering. An attacker with the Administer file types permission can craft a description that triggers scripting when an administrator views the list of file types. Root cause: inadequate ...

CVE-2022-42095

Backdrop CMS 1.23.0 contains a stored XSS vulnerability in Page content. The nuclei template identifies the vulnerable component as the Page content handling, with impact including injection of malicious scripts that could lead to data theft, session hijacking, or defacement. Root cause details i...

CVE-2019-19901

Backdrop CMS vulnerability CVE-2019-19901 affects 1.13.x before 1.13.5 and 1.14.x before 1.14.2. The issue is an XSS flaw in how block descriptions created by administrators are rendered, due to insufficient output filtering when displaying certain block descriptions. An attacker could craft a de...

CVE-2025-25062

CVE-2025-25062 is an XSS vulnerability in Backdrop CMS (CKEditor 5 module) affecting 1.28.x prior to 1.28.5 and 1.29.x prior to 1.29.3. The issue arises from insufficient isolation of long text content, enabling crafted HTML/JS to execute when an administrator edits content. Exploitation prospect...

CVE-2023-31045

Backdrop CMS

CVE-2025-25063

Backdrop CMS has an XSS vulnerability (CVE-2025-25063) in versions 1.28.x before 1.28.5 and 1.29.x before 1.29.3 due to insufficient validation of uploaded SVG images. Crafted SVGs could execute scripting when viewed directly via their URL, though sanitization occurs by embedding all uploaded SVG...

CVE-2018-1000813

The CVE concerns Backdrop CMS versions up to 1.11.0, where a Cross Site Scripting (XSS) vulnerability exists in the sanitization of custom class names used on blocks and layouts, potentially enabling JavaScript execution from an unexpected source. The attack requires a user to be directed to an a...