PatchTheCVEbackdropcms vulnerabilities
Recent CVEs affecting backdropcms products. 5 tracked.
backdropcms has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-11-18. Highest priority: CVE-2025-25062 (score 40/100).
- CVE-2025-44141 MEDIUM 6.1 DOWNGRADE A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
- CVE-2025-63828 MEDIUM 6.1 DOWNGRADE Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in p
- CVE-2025-25063 MEDIUM 4.4 UPGRADE An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
- CVE-2025-25062 MEDIUM 4.4 UPGRADE An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3
- CVE-2024-54123 MEDIUM 6.1 UPGRADE Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed
FAQ
How do I fix backdropcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is backdropcms being exploited right now?
None of the tracked backdropcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which backdropcms CVE should I patch first?
CVE-2025-25062 currently ranks highest (40/100): An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.