BA
Product
Backdrop
10
CVEs
0
On KEV
8.8
Max CVSS
3
New 30D
Severity mix
Critical 0High 3Medium 7Low 0
Watch
Add Backdrop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-45268 | 8.8 | Feb 3 | A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via… Affected: 1.20.0 |
| CVE-2026-107914 | 7.8 | Oct 9 | Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive Affected: 1.34.0 before 1.34.5; 1.35.0 before 1.35.1 |
| CVE-2026-110907 | 7.5 | Oct 15 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens Affected: 1.35.0 before 1.35.2; 1.34.0 before 1.34.6 |
| CVE-2019-14769 | 6.1 | Aug 8 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators Affected: 1.12.0 before 1.12.8; 1.13.0 before 1.13.3 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 1.11.0 before 1.11.9; 1.12.0 before 1.12.6 |
| CVE-2022-24590 | 5.4 | Feb 15 | A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML Affected: 1.21.1 |
| CVE-2026-111442 | 5.3 | Oct 16 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags Affected: 1.35.0 before 1.35.2; 1.34.0 before 1.34.6 |
| CVE-2024-41709 | 4.8 | Jul 22 | Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places Affected: 1.27.0 before 1.27.3; 1.28.0 before 1.28.2 |
| CVE-2022-42097 | 4.8 | Nov 22 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' Affected: 1.23.0 |
| CVE-2022-42094 | 4.8 | Nov 22 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content Affected: 1.23.0 |
Showing 10