Vulnerabilities

TI-2026-79891 CVE-2026-115457

Stored cross-site scripting in baserCMS via blog comment shortcodes

MEDIUM 64

baserCMS is a website development framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00421 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-79

TI-2026-79890 CVE-2026-114624

PHP object injection in baserCMS widget-area entity

HIGH 67

baserCMS is a website development framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00885 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-502

TI-2026-79889 CVE-2026-114623

Path traversal in baserCMS BcThemeFile admin screen discloses files

LOW 30

baserCMS is a website development framework.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00652 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-200

TI-2026-79888 CVE-2026-114622

baserCMS: Encoded path traversal bypass in the theme file API

HIGH 67

baserCMS is a website development framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00601 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-180

TI-2026-79887 CVE-2026-114621

SQL injection in baserCMS admin panel and admin API

MEDIUM 40

baserCMS is a website development framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00352 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-89

TI-2026-79893 CVE-2026-115480

baserCMS web API accepts mail forms without CAPTCHA check

MEDIUM 63

baserCMS is a website development framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00315 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-693

TI-2026-79892 CVE-2026-115479

Multiple recipients accepted in baserCMS mail-form auto-replies

LOW 30

baserCMS is a website development framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00302 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-20

TI-2026-79894 CVE-2026-115481

baserCMS BcCustomContent lets operators upload executable PHP files

LOW 39

baserCMS is a website development framework.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00401 Published 2026-10-23 Fixed in 5.3.2, 5.4.2 CWE-434

TI-2026-63948 CVE-2026-97150 · GHSA-m3wp-gxpc-2c5q

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes…

LOW 39

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00336 Published 2026-09-30 No fix listed CWE-829

TI-2026-53549 CVE-2026-76635 · GHSA-p3p6-469g-p4j2

baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

HIGH 76

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statemen…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00441 Published 2026-08-20 Fixed in 5.3.0 CWE-89

TI-2026-46916 CVE-2026-65875 · GHSA-p9ff-8g3w-rccv

CSV injection in baserproject BaserCMS

LOW 23

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00261 Published 2026-08-03 Fixed in 5.3.0 CWE-1236

TI-2026-25226 CVE-2026-32734 · GHSA-677c-xv24-crgx

baserCMS: Multiple vulnerabilities in baserCMS

LOW 31

baserCMS is a website development framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00268 Published 2026-03-31 Fixed in 5.2.3 CWE-79

TI-2026-23708 CVE-2026-30879 · GHSA-jmq3-x8q7-j9qm

baserCMS: Cross-site scripting vulnerability in blog post

LOW 36

baserCMS is a website development framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00242 Published 2026-03-31 Fixed in 5.2.3 CWE-79

TI-2026-23765 CVE-2026-30940 · GHSA-c5c6-37vq-pjcq

baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE

LOW 36

baserCMS is a website development framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01067 Published 2026-03-31 Fixed in 5.2.3 CWE-22

TI-2026-23707 CVE-2026-30878 · GHSA-8cr7-r8qw-gp3c

baserCMS: Mail Form Acceptance Bypass via Public API

MEDIUM 63

baserCMS is a website development framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00397 Published 2026-03-31 Fixed in 5.2.3 CWE-285

TI-2026-23706 CVE-2026-30877 · GHSA-m9g7-rgfc-jcm7

baserCMS: OS Command Injection in the baserCMS Update Functionality

MEDIUM 44

baserCMS is a website development framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01543 Published 2026-03-31 Fixed in 5.2.3 CWE-78

TI-2026-23709 CVE-2026-30880 · GHSA-6hpg-8rx3-cwgv

baserCMS: OS command injection vulnerability in installer

MEDIUM 46

baserCMS is a website development framework.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.02069 Published 2026-03-31 Fixed in 5.2.3 CWE-78

TI-2026-22074 CVE-2026-27697 · GHSA-vh89-rjph-2g7p

baserCMS: SQL injection vulnerability in blog post

LOW 37

baserCMS is a website development framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00428 Published 2026-03-31 Fixed in 5.2.3 CWE-89

TI-2026-17563 CVE-2026-21861 · GHSA-qxmc-6f24-g86g

baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

HIGH 74

baserCMS is a website development framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02322 Published 2026-03-31 Fixed in 5.2.3 CWE-78

TI-2025-23967 CVE-2025-32957 · GHSA-hv78-cwp4-8r7r

baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)

HIGH 73

baserCMS is a website development framework.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00587 Published 2026-03-31 Fixed in 5.2.3 CWE-434

TI-2024-31386 CVE-2024-46998 · GHSA-p3m2-mj3j-j49x

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature

LOW 31

baserCMS is a website development framework.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00361 Published 2024-10-24 Fixed in 5.1.2 CWE-79

TI-2024-31384 CVE-2024-46996 · GHSA-66jv-qrm3-vvfg

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature

LOW 28

baserCMS is a website development framework.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00326 Published 2024-10-24 Fixed in 5.1.2 CWE-79

TI-2024-31383 CVE-2024-46995 · GHSA-mr7q-fv7j-jcgv

baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request

LOW 27

baserCMS is a website development framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00346 Published 2024-10-24 Fixed in 5.1.2 CWE-79

TI-2024-31382 CVE-2024-46994 · GHSA-wrjc-fmfq-w3jr

baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature

LOW 24

baserCMS is a website development framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00305 Published 2024-10-24 Fixed in 5.1.2 CWE-79

TI-2024-17219 CVE-2024-26128 · GHSA-jjxq-m8h3-4vw5

baserCMS Cross-site Scripting vulnerability in Content Management

LOW 25

baserCMS is a website development framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00572 Published 2024-02-22 Fixed in 5.0.9 CWE-79

Vulnerabilities

Filters