UpHeron
All vulnerabilities

Servers and applications

CVE-2019-19900

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an editor execute scripting when creating content, aka XSS. This vulnerability is mitigated by the fact that an attacker…

Severity
Medium 4.8
Published
19 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.13.5, 1.14.2
Exploit chance
0.6% in the next 30 daysHigher than 46% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Backdrop CMSServers and applications · cpe:a:backdropcms:backdrop_cms
  • From 1.13.0 before 1.13.5
  • From 1.14.0 before 1.14.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-19900
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-19900