Known vulnerabilities in Backdrop CMS

Vendor: Backdrop CMS
Software: Backdrop CMS
Software CPE: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
Website: https://backdropcms.org/
Total vulnerabilities: 52
Public exploits: 6
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Backdrop CMS Backdrop CMS is affected by 52 known vulnerabilities: 8 high, 15 medium, 29 low Critical High Medium Low

Vulnerabilities (52)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU105896 - Improper Access Control
 CWE-284 High
No
No
 1.29.4, 1.30.2 20.03.2025 SB2025032027
#VU105894 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.29.5, 1.30.2 20.03.2025 SB2025032024
#VU102549 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.28.5, 1.29.3 13.01.2025 SB2025011318
#VU102548 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.28.5, 1.29.3 13.01.2025 SB2025011318
#VU100822 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 1.28.4, 1.29.2 22.11.2024 SB2024112215
#VU94826 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-41709		 CWE-79 Low
No
No
 1.27.3, 1.28.2 29.07.2024 SB2024072919
#VU93744 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.27.3, 1.28.2 04.07.2024 SB2024070412
#VU75351 - Improper Access Control
 CWE-284 Medium
No
No
 1.23.4, 1.24.2 19.04.2023 SB2023041947
SB2023041956
#VU73725 - Improper Access Control
 CWE-284 Low
No
No
 1.23.3, 1.24.1 15.03.2023 SB2023031541
SB2023031612
#VU65633 - Exposure of sensitive information to an unauthorized actor
CVE-2022-25275		 CWE-200 Medium
No
No
 1.21.6, 1.22.1 21.07.2022 SB2022072109
SB2022072113
SB2022101515
and 3 more
#VU61427 - Incorrect Regular Expression
CVE-2022-24729		 CWE-185 Low
No
No
 1.20.7, 1.21.4 17.03.2022 SB2022031702
SB2022031703
SB2022031704
and 24 more
#VU61426 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-24728		 CWE-79 Low
No
No
 1.20.7, 1.21.4 17.03.2022 SB2022031702
SB2022031703
SB2022031704
and 12 more
#VU60977 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-24590		 CWE-79 Low
No
No
 1.20.6, 1.21.3 03.03.2022 SB2022030308
#VU60672 - Improper input validation
CVE-2022-25271		 CWE-20 Medium
No
No
 1.20.5, 1.21.2 16.02.2022 SB2022021627
SB2022021628
SB2022101515
and 3 more
#VU58272 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-41182		 CWE-79 Medium
No
No
 1.21.0 20.11.2021 SB2021112002
SB2022011944
SB2022011946
and 32 more
#VU58270 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-41183		 CWE-79 Medium
No
No
 1.21.0 20.11.2021 SB2021112002
SB2022011943
SB2022011944
and 33 more
#VU58220 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-41164		 CWE-79 Medium
No
No
 1.19.5, 1.20.2 18.11.2021 SB2021111801
SB2021111802
SB2021111909
and 6 more
#VU58219 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-41165		 CWE-79 Medium
No
No
 1.19.5, 1.20.2 18.11.2021 SB2021111801
SB2021111802
SB2021111909
and 14 more
#VU55818 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.18.7, 1.19.3 12.08.2021 SB2021081214
SB2021081215
SB2021081220
#VU55817 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.18.7, 1.19.3 12.08.2021 SB2021081214
SB2021081215
SB2021081220


Showing elements 1 - 20 out of 52