CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 19 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

BaserCMS CSV File Injection Vulnerability

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.

CWE-1236Aug 3, 2026
CVSS5.1v4.0EPSS0.152%PoCs0SignalsSTIX

baserCMS vulnerable to stored Cross-site Scripting

Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

CWE-79Dec 7, 2022
CVSS4.8v3.1EPSS0.586%PoCs0SignalsSTIX

baserCMS vulnerable to stored Cross-site Scripting

Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

CWE-79Dec 7, 2022
CVSS4.8v3.1EPSS0.586%PoCs0SignalsSTIX

Cross-site Scripting (XSS) in baserCMS

Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.

CWE-79Mar 26, 2021
CVSS5.4v3.1EPSS0.731%PoCs0SignalsSTIX

OS Command Injection in baserCMS

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.

CWE-78Mar 26, 2021
CVSS7.2v3.1EPSS2.48%PoCs0SignalsSTIX

Cross-site Scripting (XSS) in baserCMS

Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.

CWE-79Mar 26, 2021
CVSS5.4v3.1EPSS0.731%PoCs0SignalsSTIX

baserCMS arbitrary file upload vulnerability

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.

CWE-434Jun 26, 2018
CVSS4.3v3.0EPSS1.13%PoCs0SignalsSTIX

XSS in baserCMS

Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79Jun 26, 2018
CVSS5.4v3.0EPSS0.677%PoCs0SignalsSTIX

XSS in baserCMS

Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79Jun 26, 2018
CVSS6.1v3.0EPSS0.842%PoCs0SignalsSTIX

baserCMS Access Control Bypass

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.

CWE-269Jun 26, 2018
CVSS5.3v3.0EPSS1.12%PoCs0SignalsSTIX

Sensitive Data Exposure in baserCMS

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.

CWE-200Jun 26, 2018
CVSS5.3v3.0EPSS1.18%PoCs0SignalsSTIX

OS Command Injection in baserCMS

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.

CWE-78Jun 26, 2018
CVSS8.8v3.0EPSS1.5%PoCs0SignalsSTIX

baserCMS vulnerable to Access Control Bypass

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.

Jun 26, 2018
CVSS8.1v3.0EPSS1.63%PoCs0SignalsSTIX

baserCMS SQL Injection vulnerability

SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CWE-89Aug 28, 2017
CVSS9.8v3.0EPSS1.77%PoCs0SignalsSTIX

Arbitrary file delete in baserCMS

baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being used in the mail form.

Aug 28, 2017
CVSS7.5v3.0EPSS1.42%PoCs0SignalsSTIX

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CWE-352May 12, 2017
CVSS8.8v3.0EPSS0.924%PoCs0SignalsSTIX

baserCMS Cross Site Request Forgery vulnerability

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CWE-352May 12, 2017
CVSS8.8v3.0EPSS0.944%PoCs0SignalsSTIX

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators to execute arbitrary PHP code via unspecified vectors.

CWE-352May 12, 2017
CVSS8.8v3.0EPSS0.913%PoCs0SignalsSTIX

Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79May 12, 2017
CVSS5.4v3.0EPSS0.902%PoCs0SignalsSTIX