VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Dec 19, 2019· Updated Jun 17, 2026

CVE-2019-19900

CVE-2019-19900

Description

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an editor execute scripting when creating content, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer content types" permission.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Backdrop CMS/Backdrop CMSdescription
  • Backdropcms/Backdrop CMSllm-fuzzy2 versions
    1.13.x before 1.13.5, 1.14.x before 1.14.2+ 1 more
    • (no CPE)range: 1.13.x before 1.13.5, 1.14.x before 1.14.2
    • cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*range: >=1.13.0,<1.13.5

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.