Skip to content

Vendor

basercms vulnerabilities

42 published CVES affecting basercms, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
42
Critical
1
High
23
Medium
18
Low
0
Unscored
0
CISA KEV
0
Atom feed of basercms alerts

Products

Latest basercms CVEs

Newest publication first · page 1 of 2

  2. CVE-2021-41279 Potential Zip Slip Vulnerability in baserCMS

    Published
    HighCVSS 8.8 EPSS 1.6%

    BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed...

  3. CVE-2021-39136 Cross-site scripting vulnerability in file upload

    Published
    MediumCVSS 5.4 EPSS 0.93%

    baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No...

  4. CVE-2021-20683 Cross-site Scripting (XSS) in baserCMS

    Published
    MediumCVSS 5.4 EPSS 0.73%

    Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.

  6. CVE-2021-20681 Cross-site Scripting (XSS) in baserCMS

    Published
    MediumCVSS 5.4 EPSS 0.73%

    Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.

  11. CVE-2020-15159 Cross Site Scripting and RCE in baserCMS

    Published
    HighCVSS 7.6 EPSS 2.2%

    baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and U...

  12. CVE-2020-15154 Cross Site Scripting in baserCMS

    Published
    HighCVSS 7.3 EPSS 1.0%

    baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tre...

  13. CVE-2018-18942 RCE in baserCMS before 4.1.4

    Published
    HighCVSS 7.2 EPSS 2.4%

    In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

  14. CVE-2018-18943 XSS in baserCMS before 4.1.4

    Published
    MediumCVSS 4.8 EPSS 0.73%

    An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI.

  15. CVE-2018-0575 Sensitive Data Exposure in baserCMS

    Published
    MediumCVSS 5.3 EPSS 1.2%

    baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.

  16. CVE-2018-0574 XSS in baserCMS

    Published
    MediumCVSS 6.1 EPSS 0.83%

    Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  17. CVE-2018-0573 baserCMS Access Control Bypass

    Published
    MediumCVSS 5.3 EPSS 1.1%

    baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.

  18. CVE-2018-0572 baserCMS vulnerable to Access Control Bypass

    Published
    HighCVSS 8.1 EPSS 1.6%

    baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.

  19. CVE-2018-0570 XSS in baserCMS

    Published
    MediumCVSS 5.4 EPSS 0.67%

    Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

  20. CVE-2018-0569 OS Command Injection in baserCMS

    Published
    HighCVSS 8.8 EPSS 1.5%

    baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.

  22. CVE-2017-10843 Arbitrary file delete in baserCMS

    Published
    HighCVSS 7.5 EPSS 1.4%

    baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being used in the mail form.

  23. CVE-2017-10842 baserCMS SQL Injection vulnerability

    Published
    CriticalCVSS 9.8 EPSS 1.8%

    SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  24. CVE-2017-10844 Code Injection in baserCMS

    Published
    HighCVSS 8.8 EPSS 1.5%

    baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.