CVE-2019-19903

An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer file types" permission.

• CWE-79

• https://backdropcms.org/security/backdrop-sa-core-2019-015Vendor Advisory
• https://backdropcms.org/security/backdrop-sa-core-2019-015Vendor Advisory

Published

Dec 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19898In IXP EasyInstall 6.2.13723, there are cleartext credential…7.5
• CVE-2019-19899Pebble Templates 3.1.2 allows attackers to bypass a protecti…9.8
• CVE-2019-1990In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c, there…
• CVE-2019-19900An issue was discovered in Backdrop CMS 1.13.x before 1.13.5…4.8
• CVE-2019-19901An issue was discovered in Backdrop CMS 1.13.x before 1.13.5…4.8
• CVE-2019-19902An issue was discovered in Backdrop CMS 1.13.x before 1.13.5…7.2
• CVE-2019-19905NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vul…9.8
• CVE-2019-19906cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds writ…7.5
• CVE-2019-19907HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Group…9.8
• CVE-2019-19908phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaS…6.1
• CVE-2019-19909An issue was discovered in Public Knowledge Project (PKP) pk…8.8
• CVE-2019-1991In btif_dm_data_copy of btif_core.cc, there is a possible ou…