CVE-2025-27824

An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an iFrame field.

• CWE-79

• https://backdropcms.org/security/backdrop-sa-contrib-2025-003

Published

Mar 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27819In CVE-2023-25194, we announced the RCE/Denial of service at…7.5
• CVE-2025-2782The WatchGuard Terminal Services Agent on Windows does not p…6.3
• CVE-2025-27820A bug in PSL validation logic in Apache HttpClient 5.4.x dis…7.5
• CVE-2025-27821Out-of-bounds Write vulnerability in Apache Hadoop HDFS nati…7.3
• CVE-2025-27822An issue was discovered in the Masquerade module before 1.x-…7.5
• CVE-2025-27823An issue was discovered in the Mail Disguise module before 1…6.4
• CVE-2025-27825An XSS issue was discovered in the Bootstrap 5 Lite theme be…6.4
• CVE-2025-27826An XSS issue was discovered in the Bootstrap Lite theme befo…6.4
• CVE-2025-27827A vulnerability in the legacy chat component of Mitel MiCont…7.1
• CVE-2025-27828A vulnerability in the legacy chat component of Mitel MiCont…7.1
• CVE-2025-27829An issue was discovered in Stormshield Network Security (SNS…7.3
• CVE-2025-2783Incorrect handle provided in unspecified circumstances in Mo…8.3