Cross-Site Scripting in baserCMS
Priority LOW 35CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.
Why it matters now
EPSS 0.01285 70th percentileScored 2026-11-07
Fix Fixed basercms (baserproject): < 4.3.7baserproject/basercms (Packagist): 4.3.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| baserproject | basercms | before < 4.3.7 | < 4.3.7 | Patch available | CNA |
| — | baserproject/basercms (Packagist) | 4.0.0 to before 4.3.7 | 4.3.7 | Patch available | GHSA-4r3m-j6x5-48m3 |
- basercms Vendorbaserproject Affected before < 4.3.7 Fixed in < 4.3.7 Patch available CNA
- baserproject/basercms (Packagist) Vendor— Affected 4.0.0 to before 4.3.7 Fixed in 4.3.7 Patch available GHSA-4r3m-j6x5-48m3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* | up to 4.3.6 | Vulnerable | baserproject |
- cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions up to 4.3.6 Vulnerable ·baserproject
Remediation
- Fix · CNA basercms (baserproject) Fixed in < 4.3.7
- Fix · GHSA-4r3m-j6x5-48m3 baserproject/basercms (Packagist) Fixed in 4.3.7 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
baserproject basercms < 4.3.7
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2020-11931 Cross Site Scripting leading to RCE in baserCMSPriority LOW 37
- TI-2020-11926 Cross Site Scripting in baserCMSPriority LOW 34
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15155
- 2026-10-03 Alias added: GHSA-4r3m-j6x5-48m3
References
More baserproject Basercms vulnerabilities
- TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
- TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
- TI-2026-23707 baserCMS: Mail Form Acceptance Bypass via Public API CVSS 3.1MEDIUM 5.3
- TI-2023-10935 baserCMS File Uploader Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-10936 baserCMS allows any file to be uploaded CVSS 3.1CRITICAL 9.8
- TI-2023-23483 baserCMS Code Injection Vulnerability in Mail Form Feature CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-15155 · CVE Program
- CVE-2020-15155 · NVD
- FIRST EPSS
- GHSA-4r3m-j6x5-48m3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences