CVE-2025-25062

An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.

• CWE-79

• https://backdropcms.org/security/backdrop-sa-core-2025-001Vendor Advisory
• https://medium.com/@rudranshsinghrajpurohit/cve-2025-25062-stored-cross-site-scripting-xss-in-backdrop-cms-5073df76612bExploit, Third Party Advisory
• https://www.getastra.com/blog/vulnerability/cve-2025-25062stored-cross-site-scripting-xss-in-backdrop-cms-v1-28-2/Exploit, Third Party Advisory

Published

Feb 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25057in OpenHarmony v5.0.2 and prior versions allow a local attac…5.5
• CVE-2025-25058Improper initialization for some ESXi kernel mode driver for…3.3
• CVE-2025-25059Uncontrolled search path for some Intel(R) One Boot Flash Up…6.7
• CVE-2025-2506When pglogical attempts to replicate data, it does not verif…5.3
• CVE-2025-25060Missing authentication for critical function vulnerability e…8.2
• CVE-2025-25061Unintended proxy or intermediary ('Confused Deputy') issue e…5.8
• CVE-2025-25063An XSS issue was discovered in Backdrop CMS 1.28.x before 1.…4.4
• CVE-2025-25064SQL injection vulnerability in the ZimbraSync Service SOAP e…8.8
• CVE-2025-25065SSRF vulnerability in the RSS feed parser in Zimbra Collabor…5.3
• CVE-2025-25066nDPI through 4.12 has a potential stack-based buffer overflo…8.4
• CVE-2025-25067mySCADA myPRO Manager is vulnerable to an OS command injec…9.8
• CVE-2025-25068Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11…8.8