BackdropCMS
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Backdrop | 5 | – | Oct 16, 2026 |
| Bootstrap 5 Lite theme | 1 | – | Mar 7, 2025 |
| Bootstrap Lite theme | 1 | – | Mar 7, 2025 |
| Flag | 1 | – | Apr 25, 2025 |
| GDPR cookies module for Backdrop CMS | 1 | – | May 26, 2026 |
| Link iframe formatter | 1 | – | Mar 7, 2025 |
| Mail Disguise | 1 | – | Mar 7, 2025 |
| Masquerade | 1 | – | Mar 7, 2025 |
Exploited and recent CVEs
- CVE-2026-111442 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable 0.2%
- CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data in 0.3%
- CVE-2026-107914 Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an expo 0.1%
- CVE-2025-71310 The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info conten 0.3%
- CVE-2025-46595 An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and any other type of entity. It doesn't ver 0.2%
- CVE-2025-27822 An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module provides a "Masquerade as admin" permissi 0.3%
- CVE-2025-27825 An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names. 0.2%
- CVE-2025-27826 An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names. 0.2%
- CVE-2025-27824 An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is 0.2%
- CVE-2025-27823 An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent spambots from collecting them. The module d 0.2%
- CVE-2025-25062 An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a 1.7%
- CVE-2025-25063 An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG 0.2%