Login Request a demo
BA
Vendor
Backdropcms
5 products with CVEs on record
29
CVEs
0
On KEV
3
New 30D
Products
BA
Backdrop
backdropcms
8.8
10 CVEs0 on KEV3 new
BC
Backdrop Cms
Backdropcms
9.8
16 CVEs0 on KEV0 new
BC
Backdrop Core
Backdropcms
6.1
1 CVEs0 on KEV0 new
BC
Basic Cart
Backdropcms
6.1
1 CVEs0 on KEV0 new
GC
GDPR cookies module for Backdrop CMS
BackdropCMS
1.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-111442
BA
Backdrop
BackdropCMS
5.3
0%
Oct 16Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags
CVE-2026-110907
BA
Backdrop
BackdropCMS
7.5
0%
Oct 15Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens
CVE-2026-107914
BA
Backdrop
backdropcms
7.8
0%
Oct 9Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive
CVE-2025-71310
GC
GDPR cookies module for Backdrop CMS
BackdropCMS
1.8
0%
May 26The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the…
CVE-2025-63828
BC
Backdrop Cms
Backdropcms
6.1
0%
Nov 18Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and…
CVE-2025-44141
BC
Backdrop Cms
Backdropcms
6.1
0%
Jun 26A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30
CVE-2025-25063
BC
Backdrop Cms
Backdropcms
4.4
0%
Feb 3An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
CVE-2025-25062
BC
Backdrop Cms
Backdropcms
4.4
2%
Feb 3An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
CVE-2024-54123
BC
Backdrop Cms
Backdropcms
6.1
0%
Nov 29Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format
CVE-2024-41709
BA
Backdrop
Backdropcms
4.8
0%
Jul 22Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places
CVE-2023-31045
BC
Backdrop Cms
Backdropcms
4.8
1%
Apr 24A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name…
CVE-2012-10004
BC
Basic Cart
Backdropcms
6.1
1%
Jan 11A vulnerability was found in backdrop-contrib Basic Cart on Drupal
CVE-2022-42095
BC
Backdrop Cms
Backdropcms
4.8
2%
Nov 23Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content
CVE-2022-42097
BA
Backdrop
Backdropcms
4.8
1%
Nov 22Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.'
CVE-2022-42094
BA
Backdrop
Backdropcms
4.8
3%
Nov 22Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content
CVE-2022-42096
BC
Backdrop Cms
Backdropcms
4.8
2%
Nov 21Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content
CVE-2022-42092
BC
Backdrop Cms
Backdropcms
7.2
2%
Oct 7Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution
CVE-2022-34530
BC
Backdrop Cms
Backdropcms
5.3
1%
Aug 1An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned…
CVE-2022-24590
BA
Backdrop
Backdropcms
5.4
1%
Feb 15A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML
CVE-2021-45268
BA
Backdrop
Backdropcms
8.8
2%
Feb 3A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via…
CVE-2019-19903
BC
Backdrop Cms
Backdropcms
4.8
1%
Dec 19An issue was discovered in Backdrop CMS 1.14.x before 1.14.2
CVE-2019-19902
BC
Backdrop Cms
Backdropcms
7.2
1%
Dec 19An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2
CVE-2019-19901
BC
Backdrop Cms
Backdropcms
4.8
1%
Dec 19An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2
CVE-2019-19900
BC
Backdrop Cms
Backdropcms
4.8
1%
Dec 19An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2
CVE-2019-14771
BC
Backdrop Cms
Backdropcms
9.8
3%
Aug 8Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line
CVE-2019-14770
BC
Backdrop Core
Backdropcms
6.1
1%
Aug 8In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged…
CVE-2019-14769
BA
Backdrop
Backdropcms
6.1
1%
Aug 8Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators
CVE-2019-11358
BA
Backdrop
Backdropcms
6.1
87%
Apr 20jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution
CVE-2018-1000813
BC
Backdrop Cms
Backdropcms
4.8
1%
Dec 20Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts