https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:34:24 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-22816 cnvd-2020-22816 https://cve.radiocsirt.org/vuln/cnvd-2020-22816 https://cve.radiocsirt.org/vuln/euvd-2026-59625 EUVD-2026-59625 https://cve.radiocsirt.org/vuln/euvd-2026-59625 https://cve.radiocsirt.org/vuln/fkie_cve-2019-19902 <p>An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.</p> <p>An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-19902 https://cve.radiocsirt.org/vuln/ghsa-h8jv-w343-48r6 <p>An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.</p> <p>An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.</p> https://cve.radiocsirt.org/vuln/ghsa-h8jv-w343-48r6 https://cve.radiocsirt.org/vuln/gsd-2019-19902 gsd-2019-19902 https://cve.radiocsirt.org/vuln/gsd-2019-19902