CVE-2019-19901

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would be required to have the permission to create custom blocks, which is typically an administrative task.

• CWE-79

• https://backdropcms.org/security/backdrop-sa-core-2019-013Vendor Advisory
• https://backdropcms.org/security/backdrop-sa-core-2019-013Vendor Advisory

Published

Dec 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19896In IXP EasyInstall 6.2.13723, there is Remote Code Execution…9.9
• CVE-2019-19897In IXP EasyInstall 6.2.13723, there is Remote Code Execution…9.8
• CVE-2019-19898In IXP EasyInstall 6.2.13723, there are cleartext credential…7.5
• CVE-2019-19899Pebble Templates 3.1.2 allows attackers to bypass a protecti…9.8
• CVE-2019-1990In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c, there…
• CVE-2019-19900An issue was discovered in Backdrop CMS 1.13.x before 1.13.5…4.8
• CVE-2019-19902An issue was discovered in Backdrop CMS 1.13.x before 1.13.5…7.2
• CVE-2019-19903An issue was discovered in Backdrop CMS 1.14.x before 1.14.2…4.8
• CVE-2019-19905NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vul…9.8
• CVE-2019-19906cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds writ…7.5
• CVE-2019-19907HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Group…9.8
• CVE-2019-19908phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaS…6.1