Login Request a demo
BC
Product
Backdrop Cms
by Backdropcms · last CVE Nov 18, 2025
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities16In the news0Timeline
Severity mix
Critical 1High 2Medium 13Low 0
Severity
All severities16Critical1High2Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Backdrop Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-14771
9.8
3%
Aug 8
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line
Affected: 1.12.0 before 1.12.8; 1.13.0 before 1.13.3
CVE-2022-42092
7.2
2%
Oct 7
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution
Affected: 1.22.0
CVE-2019-19902
7.2
1%
Dec 19
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2
Affected: 1.13.0 before 1.13.5; 1.14.0 before 1.14.2
CVE-2025-63828
6.1
0%
Nov 18
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and…
Affected: 1.32.1
CVE-2025-44141
6.1
0%
Jun 26
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30
Affected: 1.30.1
CVE-2024-54123
6.1
0%
Nov 29
Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format
Affected: before 1.28.4; 1.29.0 before 1.29.2
CVE-2022-34530
5.3
1%
Aug 1
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned…
Affected: through 1.22.0
CVE-2023-31045
4.8
1%
Apr 24
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name…
Affected: before 1.24.2
CVE-2022-42095
4.8
2%
Nov 23
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content
Affected: 1.23.0
CVE-2022-42096
4.8
2%
Nov 21
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content
Affected: 1.23.0
CVE-2019-19903
4.8
1%
Dec 19
An issue was discovered in Backdrop CMS 1.14.x before 1.14.2
Affected: 1.13.0 before 1.13.5; 1.14.0 before 1.14.2
CVE-2019-19901
4.8
1%
Dec 19
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2
Affected: 1.13.0 before 1.13.5; 1.14.0 before 1.14.2
CVE-2019-19900
4.8
1%
Dec 19
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2
Affected: 1.13.0 before 1.13.5; 1.14.0 before 1.14.2
CVE-2018-1000813
4.8
1%
Dec 20
Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts
Affected: through 1.11.0
CVE-2025-25063
4.4
0%
Feb 3
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
Affected: 1.28.0 before 1.28.5; 1.29.0 before 1.29.3
CVE-2025-25062
4.4
2%
Feb 3
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
Affected: 1.28.0 before 1.28.5; 1.29.0 before 1.29.3
Showing 16