Backdrop
Monthly
Information disclosure in Backdrop CMS Core's token browser allows authenticated users to enumerate available token types, though individual token names remain protected. The flaw affects versions 1.34.x before 1.34.6 and 1.35.x before 1.35.2. No public exploit has been identified, and vendor patches are available.
Information disclosure in Backdrop CMS 1.34.x before 1.34.5 and 1.35.x before 1.35.1 allows remote unauthenticated attackers to retrieve a previously generated compressed configuration export archive because the archive is not sufficiently protected during delivery. Exploitation is contingent on a configuration export having been previously requested by a user with the 'Synchronize, import, and export configuration' permission, which is the vendor-stated mitigating factor and the reason the assessed attack complexity is high. No public exploit code has been identified at the time of analysis, and the issue is fixed in Backdrop CMS 1.34.5 and 1.35.1.
Stored cross-site scripting in Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 allows an authenticated user holding SVG upload permission to embed dangerous tags or scripting inside an uploaded SVG image, which will execute in a victim's browser only if that SVG is opened directly by its raw file URL. Backdrop's design of embedding all uploaded SVGs inside <img> tags blocks that script during normal page rendering, and reaching the payload requires both the upload privilege (PR:L per the assessed vector) and a victim who navigates to the file itself, so this is a moderate-severity issue (CVSS 5.3, CWE-79) with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Information disclosure in Backdrop CMS Core's token browser allows authenticated users to enumerate available token types, though individual token names remain protected. The flaw affects versions 1.34.x before 1.34.6 and 1.35.x before 1.35.2. No public exploit has been identified, and vendor patches are available.
Information disclosure in Backdrop CMS 1.34.x before 1.34.5 and 1.35.x before 1.35.1 allows remote unauthenticated attackers to retrieve a previously generated compressed configuration export archive because the archive is not sufficiently protected during delivery. Exploitation is contingent on a configuration export having been previously requested by a user with the 'Synchronize, import, and export configuration' permission, which is the vendor-stated mitigating factor and the reason the assessed attack complexity is high. No public exploit code has been identified at the time of analysis, and the issue is fixed in Backdrop CMS 1.34.5 and 1.35.1.
Stored cross-site scripting in Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 allows an authenticated user holding SVG upload permission to embed dangerous tags or scripting inside an uploaded SVG image, which will execute in a victim's browser only if that SVG is opened directly by its raw file URL. Backdrop's design of embedding all uploaded SVGs inside <img> tags blocks that script during normal page rendering, and reaching the payload requires both the upload privilege (PR:L per the assessed vector) and a victim who navigates to the file itself, so this is a moderate-severity issue (CVSS 5.3, CWE-79) with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.