baserproject Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with basercms.

Products

Clear product

Showing 25 vulnerabilities on this page for basercms

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

baserCMS: Multiple vulnerabilities in baserCMS

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3.

CWE-79Mar 31, 2026
CVSS7.1v3.1EPSS0.258%PoCs0SignalsSTIX

baserCMS: Cross-site scripting vulnerability in blog post

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3.

CWE-79Mar 31, 2026
CVSS6.9v4.0EPSS0.233%PoCs0SignalsSTIX

baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE

baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.

CWE-22CWE-73Mar 31, 2026
CVSS7.2v3.1EPSS1.05%PoCs0SignalsSTIX

baserCMS: Mail Form Acceptance Bypass via Public API

baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.

CWE-285Mar 31, 2026
CVSS5.3v3.1EPSS0.382%PoCs0SignalsSTIX

baserCMS: OS Command Injection in the baserCMS Update Functionality

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.

CWE-78Mar 31, 2026
CVSS9.1v3.1EPSS1.52%PoCs0SignalsSTIX

baserCMS: OS command injection vulnerability in installer

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.

CWE-78Mar 31, 2026
CVSS9.2v4.0EPSS2.03%PoCs0SignalsSTIX

baserCMS: SQL injection vulnerability in blog post

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.

CWE-89Mar 31, 2026
CVSS6.9v4.0EPSS0.412%PoCs0SignalsSTIX

baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.

CWE-78Mar 31, 2026
CVSS9.1v3.1EPSS2.28%PoCs0SignalsSTIX

baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.

CWE-434Mar 31, 2026
CVSS8.7v3.1EPSS0.577%PoCs0SignalsSTIX

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature

baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Edit Email Form Settings Feature. Version 5.1.2 fixes the issue.

CWE-79Oct 24, 2024
CVSS-v4.0EPSS0.337%PoCs0SignalsSTIX

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature

baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Blog posts feature. Version 5.1.2 fixes this issue.

CWE-79Oct 24, 2024
CVSS-v4.0EPSS0.307%PoCs0SignalsSTIX

baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request

baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes this issue.

CWE-79Oct 24, 2024
CVSS6.1v3.1EPSS0.323%PoCs0SignalsSTIX

baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature

baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in Blog posts and Contents list Feature. Version 5.1.2 fixes this issue.

CWE-79Oct 24, 2024
CVSS5.4v3.1EPSS0.288%PoCs0SignalsSTIX

baserCMS Cross-site Scripting vulnerability in Content Management

baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5.0.9 contains a fix for this vulnerability.

CWE-79Feb 22, 2024
CVSS5.4v3.1EPSS0.572%PoCs0SignalsSTIX

baserCMS OS command injection vulnerability in Installer

baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.

CWE-78Feb 22, 2024
CVSS5.6v3.1EPSS1.46%PoCs0SignalsSTIX

baserCMS Cross-site Scripting vulnerability in Site search Feature

baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.

CWE-79Feb 22, 2024
CVSS6.1v3.1EPSS0.47%PoCs0SignalsSTIX

baserCMS Code Injection Vulnerability in Mail Form Feature

baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available.

CWE-94Oct 30, 2023
CVSS9.8v3.1EPSS0.573%PoCs0SignalsSTIX

baserCMS CSRF vulnerability in Content preview Feature

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.

CWE-352Oct 30, 2023
CVSS4.7v3.1EPSS0.347%PoCs0SignalsSTIX

baserCMS Directory Traversal vulnerability in Form submission data management Feature

baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue.

CWE-22Oct 30, 2023
CVSS4.9v3.1EPSS0.97%PoCs0SignalsSTIX

baserCMS Cross-site Scripting vulnerability in File upload Feature

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue.

CWE-79Oct 30, 2023
CVSS6.1v3.1EPSS0.509%PoCs0SignalsSTIX

basercms XSS Vulnerability via Favorites Feature

baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0.

CWE-79Oct 27, 2023
CVSS6.1v3.1EPSS0.47%PoCs0SignalsSTIX

baserCMS allows any file to be uploaded

baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.

CWE-434Mar 23, 2023
CVSS9.8v3.1EPSS1.09%PoCs0SignalsSTIX

baserCMS File Uploader Remote Code Execution (RCE) vulnerability

baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.

CWE-434Mar 23, 2023
CVSS9.8v3.1EPSS1.53%PoCs0SignalsSTIX

Cross-site scripting vulnerability in BaserCMS

BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. Users of baserCMS are advised to upgrade as soon as possible. There are no known workarounds for this vulnerability.

CWE-79Nov 25, 2022
CVSS4.6v3.1EPSS0.547%PoCs0SignalsSTIX

Zip Slip Vulnerability in BaserCMS

BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

CWE-22Nov 26, 2021
CVSS7.7v3.1EPSS1.57%PoCs0SignalsSTIX