baserproject

Records79All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high35CVSS 7.0–8.9

Exploited now

baserproject records in CISA KEV

No baserproject vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Basercms 68 records HIGH Mail 2 records MEDIUM

Records

79 records

TI-2026-53549 CVE-2026-76635 · GHSA-p3p6-469g-p4j2

baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

HIGH 76

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statemen…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00441 Published 2026-08-20 Fixed in 5.3.0 CWE-89

TI-2026-17563 CVE-2026-21861 · GHSA-qxmc-6f24-g86g

baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

HIGH 74

baserCMS is a website development framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02322 Published 2026-03-31 Fixed in 5.2.3 CWE-78

TI-2025-23967 CVE-2025-32957 · GHSA-hv78-cwp4-8r7r

baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)

HIGH 73

baserCMS is a website development framework.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00587 Published 2026-03-31 Fixed in 5.2.3 CWE-434

TI-2026-79890 CVE-2026-114624

PHP object injection in baserCMS widget-area entity

HIGH 67

baserCMS is a website development framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00885 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-502

TI-2026-79888 CVE-2026-114622

baserCMS: Encoded path traversal bypass in the theme file API

HIGH 67

baserCMS is a website development framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00601 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-180

TI-2026-79891 CVE-2026-115457

Stored cross-site scripting in baserCMS via blog comment shortcodes

MEDIUM 64

baserCMS is a website development framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00421 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-79

TI-2026-79893 CVE-2026-115480

baserCMS web API accepts mail forms without CAPTCHA check

MEDIUM 63

baserCMS is a website development framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00315 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-693

TI-2026-23707 CVE-2026-30878 · GHSA-8cr7-r8qw-gp3c

baserCMS: Mail Form Acceptance Bypass via Public API

MEDIUM 63

baserCMS is a website development framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00397 Published 2026-03-31 Fixed in 5.2.3 CWE-285

TI-2023-10935 CVE-2023-25654 · GHSA-h4cc-fxpp-pgw9

baserCMS File Uploader Remote Code Execution (RCE) vulnerability

MEDIUM 52

baserCMS is a Content Management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01533 Published 2023-03-23 Fixed in 4.7.4, 4.7.5 CWE-434

TI-2023-10936 CVE-2023-25655 · GHSA-mfvg-qwcw-qvc8

baserCMS allows any file to be uploaded

MEDIUM 51

baserCMS is a Content Management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01089 Published 2023-03-23 Fixed in 4.7.5 CWE-434

TI-2023-23483 CVE-2023-43792 · GHSA-vrm6-c878-fpq6

baserCMS Code Injection Vulnerability in Mail Form Feature

MEDIUM 49

baserCMS is a website development framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00675 Published 2023-10-30 No fix listed CWE-94

TI-2026-23709 CVE-2026-30880 · GHSA-6hpg-8rx3-cwgv

baserCMS: OS command injection vulnerability in installer

MEDIUM 46

baserCMS is a website development framework.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.02069 Published 2026-03-31 Fixed in 5.2.3 CWE-78

TI-2017-07943 CVE-2017-10842 · GHSA-jc94-wp59-pq4f

SQL injection in baserproject baserCMS

MEDIUM 46

SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01766 Published 2017-08-28 Fixed in 3.0.15, 4.0.6 CWE-89

TI-2026-23706 CVE-2026-30877 · GHSA-m9g7-rgfc-jcm7

baserCMS: OS Command Injection in the baserCMS Update Functionality

MEDIUM 44

baserCMS is a website development framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01543 Published 2026-03-31 Fixed in 5.2.3 CWE-78

TI-2021-18078 CVE-2021-41243 · GHSA-7rpc-9m88-cf9w

OS Command Injection Vulnerability and Potential Zip Slip Vulnerability

MEDIUM 43

There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.02173 Published 2021-11-26 Fixed in 4.5.4 CWE-78

TI-2023-23375 CVE-2023-43649 · GHSA-fw9x-cqjq-7jx5

baserCMS CSRF vulnerability in Content preview Feature

MEDIUM 42

baserCMS is a website development framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00421 Published 2023-10-30 Fixed in 4.8.0 CWE-352

TI-2021-18111 CVE-2021-41279 · GHSA-4x2f-54wr-4hjg

Zip Slip Vulnerability in BaserCMS

MEDIUM 41

BaserCMS is an open source content management system with a focus on Japanese language support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01616 Published 2021-11-26 Fixed in 4.5.3, 4.5.4 CWE-22

TI-2018-00526 CVE-2018-0569 · GHSA-6j3p-vrph-j7qq

OS command injection in baserproject baserCMS

MEDIUM 41

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01476 Published 2018-06-26 No fix listed CWE-78

TI-2017-07945 CVE-2017-10844 · GHSA-69gw-v5ph-6vxq

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary…

MEDIUM 41

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01467 Published 2017-08-28 No fix listed CWE-94

TI-2026-79887 CVE-2026-114621

SQL injection in baserCMS admin panel and admin API

MEDIUM 40

baserCMS is a website development framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00352 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-89

TI-2020-12046 CVE-2020-15276 · GHSA-fw5q-j9p4-3vxg

Cross Site Scripting in baserCMS

MEDIUM 40

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01002 Published 2020-10-30 Fixed in 4.4.1 CWE-79

TI-2016-04230 CVE-2016-4887 · GHSA-gxqg-c4hq-9hvc

Cross-site request forgery in baserproject baserCMS plugin Uploader

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00924 Published 2017-05-12 No fix listed CWE-352

TI-2016-04229 CVE-2016-4886 · GHSA-3wpm-6h7w-pwwg

Cross-site request forgery in baserproject baserCMS plugin Mail

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00924 Published 2017-05-12 No fix listed CWE-352

TI-2016-04228 CVE-2016-4885 · GHSA-m4pp-93r3-w496

Cross-site request forgery in baserproject baserCMS plugin Feed

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00924 Published 2017-05-12 No fix listed CWE-352

TI-2016-04227 CVE-2016-4884 · GHSA-7pp5-3j89-6wmq

Cross-site request forgery in baserproject baserCMS plugin Blog

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00924 Published 2017-05-12 No fix listed CWE-352

Open these records in search →