Backdropcms Backdrop
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Backdropcms Backdrop.
By the Year
In 2026 there have been 0 vulnerabilities in Backdropcms Backdrop. Last year, in 2025 Backdrop had 3 security vulnerabilities published. Right now, Backdrop is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 3 | 0.00 |
| 2024 | 1 | 4.80 |
| 2023 | 1 | 4.80 |
| 2022 | 5 | 5.72 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 2 | 6.10 |
It may take a day or so for new Backdrop vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Backdropcms Backdrop Security Vulnerabilities
Backdrop CMS 1.30 XSS in Node Creation Form, fixed in 1.31
CVE-2025-44141
- June 26, 2025
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
Backdrop CMS Flag module XSS before 1.x-3.6.2
CVE-2025-46595
- April 25, 2025
An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and any other type of entity. It doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow crafted HTML to result in Cross Site Scripting. This is mitigated by the fact that an attacker must have a role with permission to create links on the website, for example: create or edit comments or content with a filtered text format.
Backdrop CMS 1.28.x/1.29.x XSS via SVG Upload
CVE-2025-25063
- February 03, 2025
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.
Backdrop CMS 1.27.3-1.28.2 Field Label XSS Vulnerability
CVE-2024-41709
4.8 - Medium
- July 22, 2024
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
XSS
Stored XSS via 'name' param in Backdrop CMS 1.24.2 Text Editor
CVE-2023-31045
4.8 - Medium
- April 24, 2023
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
XSS
Stored XSS in Backdrop CMS 1.23.0 via Comment
CVE-2022-42097
4.8 - Medium
- November 22, 2022
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
XSS
Backdrop CMS 1.23.0 XSS via Card Content
CVE-2022-42094
4.8 - Medium
- November 22, 2022
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
XSS
Backdrop CMS 1.23 XSS via Stored Post Content (CVE202242096)
CVE-2022-42096
4.8 - Medium
- November 21, 2022
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
XSS
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1
CVE-2022-24590
5.4 - Medium
- February 15, 2022
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
XSS
A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which
CVE-2021-45268
8.8 - High
- February 03, 2022
A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cookie of a high-privileged authenticated user who is entitled to install arbitrary add-ons
Session Riding
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators
CVE-2019-14769
- August 08, 2019
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering a layout. (This issue is mitigated by the attacker needing permission to create custom blocks on the site, which is typically an administrative permission.)
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {},
CVE-2019-11358
6.1 - Medium
- April 20, 2019
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Prototype Pollution
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Backdropcms Backdrop or by Backdropcms? Click the Watch button to subscribe.
