Read the docs
TI-2012-01145 Aliases CVE-2012-1248GHSA-cg48-596p-vf3x

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations…

Priority LOW 28CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain.

Why it matters now

EPSS 0.02669 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*up to 1.6.15Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.5.4:*:*:*:*:*:*:*1.5.4Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.5.5:*:*:*:*:*:*:*1.5.5Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.5.6:*:*:*:*:*:*:*1.5.6Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.5.7:*:*:*:*:*:*:*1.5.7Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.5.8:*:*:*:*:*:*:*1.5.8Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.5.9:*:*:*:*:*:*:*1.5.9Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.0:*:*:*:*:*:*:*1.6.0Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.1:*:*:*:*:*:*:*1.6.1Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.2:*:*:*:*:*:*:*1.6.2Vulnerablebaserproject
  • cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions up to 1.6.15 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.5.4:*:*:*:*:*:*:* Versions 1.5.4 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.5.5:*:*:*:*:*:*:* Versions 1.5.5 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.5.6:*:*:*:*:*:*:* Versions 1.5.6 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.5.7:*:*:*:*:*:*:* Versions 1.5.7 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.5.8:*:*:*:*:*:*:* Versions 1.5.8 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.5.9:*:*:*:*:*:*:* Versions 1.5.9 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·baserproject
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:basercms:basercms:1.6.3:*:*:*:*:*:*:*1.6.3Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.4:*:*:*:*:*:*:*1.6.4Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.5:*:*:*:*:*:*:*1.6.5Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.6:*:*:*:*:*:*:*1.6.6Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.7:*:*:*:*:*:*:*1.6.7Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.7.1:*:*:*:*:*:*:*1.6.7.1Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.8:*:*:*:*:*:*:*1.6.8Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.9:*:*:*:*:*:*:*1.6.9Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.9.1:*:*:*:*:*:*:*1.6.9.1Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.10:*:*:*:*:*:*:*1.6.10Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.11:*:*:*:*:*:*:*1.6.11Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.11.1:*:*:*:*:*:*:*1.6.11.1Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.11.2:*:*:*:*:*:*:*1.6.11.2Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.11.3:*:*:*:*:*:*:*1.6.11.3Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.11.4:*:*:*:*:*:*:*1.6.11.4Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.12:*:*:*:*:*:*:*1.6.12Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.13:*:*:*:*:*:*:*1.6.13Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.13.1:*:*:*:*:*:*:*1.6.13.1Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.13.6:*:*:*:*:*:*:*1.6.13.6Vulnerablebaserproject
cpe:2.3:a:basercms:basercms:1.6.14:*:*:*:*:*:*:*1.6.14Vulnerablebaserproject
  • cpe:2.3:a:basercms:basercms:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.7.1:*:*:*:*:*:*:* Versions 1.6.7.1 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.9.1:*:*:*:*:*:*:* Versions 1.6.9.1 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.10:*:*:*:*:*:*:* Versions 1.6.10 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.11:*:*:*:*:*:*:* Versions 1.6.11 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.11.1:*:*:*:*:*:*:* Versions 1.6.11.1 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.11.2:*:*:*:*:*:*:* Versions 1.6.11.2 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.11.3:*:*:*:*:*:*:* Versions 1.6.11.3 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.11.4:*:*:*:*:*:*:* Versions 1.6.11.4 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.12:*:*:*:*:*:*:* Versions 1.6.12 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.13:*:*:*:*:*:*:* Versions 1.6.13 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.13.1:*:*:*:*:*:*:* Versions 1.6.13.1 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.13.6:*:*:*:*:*:*:* Versions 1.6.13.6 Vulnerable ·baserproject
  • cpe:2.3:a:basercms:basercms:1.6.14:*:*:*:*:*:*:* Versions 1.6.14 Vulnerable ·baserproject

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-1248
  2. 2026-10-03 Alias added: GHSA-cg48-596p-vf3x

References

Advisory 3

  • TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
  • TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
  • TI-2026-23707 baserCMS: Mail Form Acceptance Bypass via Public API CVSS 3.1MEDIUM 5.3
  • TI-2023-10935 baserCMS File Uploader Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-10936 baserCMS allows any file to be uploaded CVSS 3.1CRITICAL 9.8
  • TI-2023-23483 baserCMS Code Injection Vulnerability in Mail Form Feature CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences