CVE-2025-25062
published 2025-02-03CVE-2025-25062: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor…
PriorityP428medium4.4CVSS 3.1
AVNACHPRLUIRSCCLILAN
EXPLOIT
EPSS
1.64%
73.4th percentile
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| backdropcms | backdrop | >= 1.28.0 < 1.28.5 | 1.28.5 |
| backdropcms | backdrop | >= 1.29.0 < 1.29.3 | 1.29.3 |
| backdropcms | backdrop_cms | >= 1.28.0 < 1.28.5 | 1.28.5 |
| backdropcms | backdrop_cms | >= 1.29.0 < 1.29.3 | 1.29.3 |
| msrc | azl3_libxml2_2.11.5-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_libxml2_2.11.5-5_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libxml2_2.10.4-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_libxml2_2.10.4-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
vendor_msrc7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vrh8-g8q9-jhc6: An XSS issue was discovered in Backdrop CMS 1
ghsa_unreviewed·2025-02-03
CVE-2025-25062 [MEDIUM] CWE-79 GHSA-vrh8-g8q9-jhc6: An XSS issue was discovered in Backdrop CMS 1
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
Microsoft
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled processing crafted XML documents can l
vendor_msrc·2024-02-13·CVSS 7.5
CVE-2024-25062 [HIGH] CWE-416 An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled processing crafted XML documents can l
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additi
No detection rules found.
Nuclei
Backdrop CMS - Cross-Site Scripting
nuclei·CVSS 4.4
CVE-2025-25062 [MEDIUM] Backdrop CMS - Cross-Site Scripting
Backdrop CMS - Cross-Site Scripting
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
Template:
id: CVE-2025-25062
info:
name: Backdrop CMS - Cross-Site Scripting
author: soonghee2
severity: medium
de
No writeups or analysis indexed.
2025-02-03
Published