Read the docs
TI-2020-12043 Aliases CVE-2020-15273GHSA-wpww-4jf4-4hx8

Cross-Site Scripting in baserCMS

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1.

Why it matters now

EPSS 0.01029 63rd percentileScored 2026-11-07
Fix Fixed basercms (baserproject): 4.4.1baserproject/basercms (Packagist): 4.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
baserprojectbasercms4.0.0 to before 4.4.14.4.1Patch availableCNA
—baserproject/basercms (Packagist)4.4.0 to before 4.4.14.4.1Patch availableGHSA-wpww-4jf4-4hx8
  • basercms Vendorbaserproject Affected 4.0.0 to before 4.4.1 Fixed in 4.4.1 Patch available CNA
  • baserproject/basercms (Packagist) Vendor— Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-wpww-4jf4-4hx8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*4.0.0 to before 4.4.1Vulnerablebaserproject
  • cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.4.1 Vulnerable ·baserproject

Remediation

  • Fix · CNA basercms (baserproject) Fixed in 4.4.1
  • Fix · GHSA-wpww-4jf4-4hx8 baserproject/basercms (Packagist) Fixed in 4.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15273
  2. 2026-10-03 Alias added: GHSA-wpww-4jf4-4hx8

References

Patch 2

Advisory 2

  • TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
  • TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
  • TI-2026-23707 baserCMS: Mail Form Acceptance Bypass via Public API CVSS 3.1MEDIUM 5.3
  • TI-2023-10935 baserCMS File Uploader Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-10936 baserCMS allows any file to be uploaded CVSS 3.1CRITICAL 9.8
  • TI-2023-23483 baserCMS Code Injection Vulnerability in Mail Form Feature CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences