backdropcms vulnerabilities

CVEs per yearBy the year they were published

1. 20258
2. 20264

Newest CVEs

• CVE-2026-111442

  Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous…

  BackdropCMS · Backdrop

  Medium5.3
• CVE-2026-110907

  Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name])…

  BackdropCMS · Backdrop

  High7.5
• CVE-2026-107914

  Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This…

  backdropcms · Backdrop

  High7.8
• CVE-2025-71310

  The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been…

  BackdropCMS · GDPR cookies module for Backdrop CMS

  Low1.8
• CVE-2025-46595

  An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and…

  backdropcms · Flag

  Medium6.4
• CVE-2025-27826

  An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.

  backdropcms · Bootstrap Lite theme

  Medium6.4
• CVE-2025-27825

  An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.

  backdropcms · Bootstrap 5 Lite theme

  Medium6.4
• CVE-2025-27824

  An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying…

  backdropcms · Link iframe formatter

  Medium6.4
• CVE-2025-27823

  An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent…

  backdropcms · Mail Disguise

  Medium6.4
• CVE-2025-27822

  An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module…

  backdropcms · Masquerade

  High7.5