Skip to content
OpenAdvisories

Package · Packagist

backdrop/backdrop

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-63828

    Backdrop CMS Host Header Injection vulnerability

    Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

    backdrop/backdrop Packagist
  • Medium 6.1
    CVE-2024-41709

    Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places

    Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.

    backdrop/backdrop Packagist
  • Medium 4.8
    CVE-2023-31045

    Cross-site Scripting in Backdrop CMS

    A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as a…

    backdrop/backdrop Packagist
  • Medium 4.8
    CVE-2022-42095 Public exploit

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.

    backdrop/backdrop Packagist
  • Medium 4.8
    CVE-2022-42097 Public exploit

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .

    backdrop/backdrop Packagist
  • Medium 4.8
    CVE-2022-42094 Public exploit

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.

    backdrop/backdrop Packagist
  • Medium 4.8
    CVE-2022-42096 Public exploit

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.

    backdrop/backdrop Packagist