CVE-2026-45430

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Backdrop CMS contributed projects	backdrop-contrib/salesforce	< 1.x-1.0.1

References

https://backdropcms.org/security/backdrop-sa-contrib-2026-001

Timeline

Published: May 12, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-454318.7This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic functions in its web CVE-2026-454328.7This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in its web management in CVE-2026-454338.7This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote CVE-2026-454349.8Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Ap CVE-2026-454356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-B CVE-2026-454366.5Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.CVE-2026-454377.1Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-454387.5Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Secur CVE-2026-454399.3Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.CVE-2026-45444.8A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the componen CVE-2026-454407.6Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.CVE-2026-454417.5Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.