TI-2020-11926 Aliases CVE-2020-15154 GHSA-cpxc-67rc-c775

Cross Site Scripting in baserCMS

LOW 34CWE-79Published 2020-08-28 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js. The issue is fixed in version 4.3.7.

Why it matters now

EPSS 0.01011 63rd percentileScored 2026-11-07

Fix Fixed basercms (baserproject): < 4.3.7baserproject/basercms (Packagist): 4.3.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
baserproject	basercms	before < 4.3.7	< 4.3.7	Patch available	CNA
—	baserproject/basercms (Packagist)	4.0.0 to before 4.3.7	4.3.7	Patch available	GHSA-cpxc-67rc-c775

basercms Vendorbaserproject Affected before < 4.3.7 Fixed in < 4.3.7 Patch available CNA
baserproject/basercms (Packagist) Vendor— Affected 4.0.0 to before 4.3.7 Fixed in 4.3.7 Patch available GHSA-cpxc-67rc-c775

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:basercms:basercms::::::::	up to 4.3.6	Vulnerable	baserproject

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions up to 4.3.6 Vulnerable ·baserproject

Remediation

Fix · CNA basercms (baserproject) Fixed in < 4.3.7
Fix · GHSA-cpxc-67rc-c775 baserproject/basercms (Packagist) Fixed in 4.3.7 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2020-08-28
baserproject basercms < 4.3.7
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2020-11931 Cross Site Scripting leading to RCE in baserCMSPriority LOW 37
- TI-2020-11927 Cross-Site Scripting in baserCMSPriority LOW 35
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-15154
2026-10-03 Alias added: GHSA-cpxc-67rc-c775

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-15154

Other 1

https://github.com/baserproject/basercms/commit/7f4b905b90954e394ec10dd35bad2a5dec505371

TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
TI-2026-23707 baserCMS: Mail Form Acceptance Bypass via Public API CVSS 3.1MEDIUM 5.3
TI-2023-10935 baserCMS File Uploader Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.8
TI-2023-10936 baserCMS allows any file to be uploaded CVSS 3.1CRITICAL 9.8
TI-2023-23483 baserCMS Code Injection Vulnerability in Mail Form Feature CVSS 3.1CRITICAL 9.8

See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences