PatchTheCVE: backdropcmshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-63828: Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in phttps://patchthecve.com/cve/CVE-2025-63828.htmlhttps://patchthecve.com/cve/CVE-2025-63828.htmlWed, 17 Jun 2026 09:53:30 +0000MEDIUM 6.1: Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.CVE-2025-44141: A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.https://patchthecve.com/cve/CVE-2025-44141.htmlhttps://patchthecve.com/cve/CVE-2025-44141.htmlSun, 05 Jul 2026 01:21:40 +0000MEDIUM 6.1: A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.CVE-2025-25063: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3https://patchthecve.com/cve/CVE-2025-25063.htmlhttps://patchthecve.com/cve/CVE-2025-25063.htmlWed, 17 Jun 2026 09:00:13 +0000MEDIUM 4.4: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it CVE-2025-25062: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3https://patchthecve.com/cve/CVE-2025-25062.htmlhttps://patchthecve.com/cve/CVE-2025-25062.htmlWed, 17 Jun 2026 09:00:13 +0000MEDIUM 4.4: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administraCVE-2024-54123: Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed https://patchthecve.com/cve/CVE-2024-54123.htmlhttps://patchthecve.com/cve/CVE-2024-54123.htmlWed, 17 Jun 2026 08:09:48 +0000MEDIUM 6.1: Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.CVE-2024-41709: Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they arhttps://patchthecve.com/cve/CVE-2024-41709.htmlhttps://patchthecve.com/cve/CVE-2024-41709.htmlWed, 17 Jun 2026 07:48:05 +0000MEDIUM 4.8: Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.