CVE-2011-4923: Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly ea...

Security readout for executives and security teams

BackupPC’s web interface had a cross-site scripting flaw in the log file viewer. An attacker could inject script through the num parameter in a view action. Business impact depends on who can reach the BackupPC CGI interface and whether administrators use it while authenticated. Exposure is most likely where BackupPC’s CGI web interface is reachable by users, administrators, or internal networks. Internet-facing backup consoles would raise concern. The source bundle does not provide CPEs or a complete affected-version boundary. Treat this as a targeted administrative-console risk. It is not marked as actively exploited in the supplied evidence, but backup systems are sensitive. Patch or restrict access during normal vulnerability remediation cycles, faster if exposed beyond trusted administrators. Mitigation focus: Identify all BackupPC web interface deployments and installed versions.; Apply BackupPC or distribution security updates from trusted vendor guidance.; Restrict BackupPC CGI access to authorized administrators and trusted networks..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.