TI-2020-11931 Aliases CVE-2020-15159 GHSA-673x-f5wx-fxpw

Cross Site Scripting leading to RCE in baserCMS

LOW 37CWE-79Published 2020-08-28 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.

Why it matters now

EPSS 0.02152 82nd percentileScored 2026-11-07

Fix Fixed basercms (baserproject): < 4.3.7baserproject/basercms (Packagist): 4.3.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
baserproject	basercms	before < 4.3.7	< 4.3.7	Patch available	CNA
—	baserproject/basercms (Packagist)	4.0.0 to before 4.3.7	4.3.7	Patch available	GHSA-673x-f5wx-fxpw

basercms Vendorbaserproject Affected before < 4.3.7 Fixed in < 4.3.7 Patch available CNA
baserproject/basercms (Packagist) Vendor— Affected 4.0.0 to before 4.3.7 Fixed in 4.3.7 Patch available GHSA-673x-f5wx-fxpw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:basercms:basercms::::::::	up to 4.3.6	Vulnerable	baserproject

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions up to 4.3.6 Vulnerable ·baserproject

Remediation

Fix · CNA basercms (baserproject) Fixed in < 4.3.7
Fix · GHSA-673x-f5wx-fxpw baserproject/basercms (Packagist) Fixed in 4.3.7 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2020-08-28
baserproject basercms < 4.3.7
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2020-11927 Cross-Site Scripting in baserCMSPriority LOW 35
- TI-2020-11926 Cross Site Scripting in baserCMSPriority LOW 34
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-15159
2026-10-03 Alias added: GHSA-673x-f5wx-fxpw

References

Patch 2

Advisory 2

TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
TI-2026-23707 baserCMS: Mail Form Acceptance Bypass via Public API CVSS 3.1MEDIUM 5.3
TI-2023-10935 baserCMS File Uploader Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.8
TI-2023-10936 baserCMS allows any file to be uploaded CVSS 3.1CRITICAL 9.8
TI-2023-23483 baserCMS Code Injection Vulnerability in Mail Form Feature CVSS 3.1CRITICAL 9.8

See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences