CVE-2022-42094

CVE-2022-42094 concerns Backdrop CMS, version 1.23.0, with a stored XSS bug in the Card content. The NVD/Nucli-templates describe a stored XSS that could allow an attacker to run arbitrary JavaScript in a victim’s browser, potentially enabling session hijacking, defacement, or theft of informatio...

CVE-2022-24590

BackdropCMS v1.21.1 is affected by a stored cross-site scripting (XSS) vulnerability in the Add Link function. The root cause is insufficient validation of client-side data, enabling attackers to execute arbitrary web scripts/HTML when the vulnerable entry is processed. Sources corroborate the is...

CVE-2022-42097

Backdrop CMS 1.23.0 contains a stored cross-site scripting (XSS) vulnerability in the Comment feature. The root cause is lack of proper filtering/escaping of user-supplied data. The CVSS metrics indicate a Medium severity (4.8) with network attack vector, high privileges required, and user intera...

CVE-2021-45268

CVE-2021-45268 concerns Backdrop CMS 1.20 with a CSRF vulnerability that can lead to remote code execution on the hosting server by uploading a crafted PHP add-on. The vendor notes the attack requires a high-privileged authenticated user with permission to install add-ons. Multiple sources (NVD, ...