https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:30:17 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-31330 cnvd-2019-31330 https://cve.radiocsirt.org/vuln/cnvd-2019-31330 https://cve.radiocsirt.org/vuln/euvd-2026-56604 EUVD-2026-56604 https://cve.radiocsirt.org/vuln/euvd-2026-56604 https://cve.radiocsirt.org/vuln/fkie_cve-2019-14771 <p>Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.) Note: This has been disputed by multiple 3rd parties due to advanced permissions that are needed to exploit.</p> <p>Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.) Note: This has been disputed by multiple 3rd parties due to advanced permissions that are needed to exploit.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-14771 https://cve.radiocsirt.org/vuln/ghsa-vcm5-8725-vff8 <p>Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.)</p> <p>Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the &#34;Synchronize, import, and export configuration&#34; permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.)</p> https://cve.radiocsirt.org/vuln/ghsa-vcm5-8725-vff8 https://cve.radiocsirt.org/vuln/gsd-2019-14771 gsd-2019-14771 https://cve.radiocsirt.org/vuln/gsd-2019-14771