BA
Product
basercms
25
CVEs
0
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 2High 11Medium 12Low 0
Watch
Add basercms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30880 | 9.8 | Mar 31 | baserCMS: OS command injection vulnerability in installer Affected: < 5.2.3 |
| CVE-2026-27697 | 9.8 | Mar 31 | baserCMS: SQL injection vulnerability in blog post Affected: < 5.2.3 |
| CVE-2026-114621 New | 8.8 | Oct 23 | baserCMS: SQL injection in the admin panel and admin API Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-115481 New | 8.5 | Oct 23 | baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload Affected: >= 5.0.0-beta1, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2023-51450 | 8.1 | Feb 22 | baserCMS OS command injection vulnerability in Installer Affected: < 5.0.9 |
| CVE-2026-114624 New | 7.2 | Oct 23 | baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-114622 New | 7.2 | Oct 23 | baserCMS: Encoded path traversal bypass in the theme file API Affected: >= 5.2.3, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-76635 | 7.2 | Aug 20 | baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php Affected: before 5.3.0 |
| CVE-2026-30940 | 7.2 | Mar 31 | baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE Affected: < 5.2.3 |
| CVE-2026-30877 | 7.2 | Mar 31 | baserCMS: OS Command Injection in the baserCMS Update Functionality Affected: < 5.2.3 |
| CVE-2026-21861 | 7.2 | Mar 31 | baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) Affected: < 5.2.3 |
| CVE-2025-32957 | 7.2 | Mar 31 | baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) Affected: < 5.2.3 |
| CVE-2026-115457 New | 7.1 | Oct 23 | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-114623 New | 6.5 | Oct 23 | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-32734 | 6.1 | Mar 31 | baserCMS: Multiple vulnerabilities in baserCMS Affected: < 5.2.3 |
| CVE-2026-30879 | 6.1 | Mar 31 | baserCMS: Cross-site scripting vulnerability in blog post Affected: < 5.2.3 |
| CVE-2024-46995 | 6.1 | Oct 24 | baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request Affected: < 5.1.2 |
| CVE-2023-44379 | 6.1 | Feb 22 | baserCMS Cross-site Scripting vulnerability in Site search Feature Affected: < 5.0.9 |
| CVE-2024-46998 | 5.4 | Oct 24 | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature Affected: < 5.1.2 |
| CVE-2024-46996 | 5.4 | Oct 24 | baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature Affected: < 5.1.2 |
| CVE-2024-46994 | 5.4 | Oct 24 | baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature Affected: < 5.1.2 |
| CVE-2024-26128 | 5.4 | Feb 22 | baserCMS Cross-site Scripting vulnerability in Content Management Affected: < 5.0.9 |
| CVE-2026-115480 New | 5.3 | Oct 23 | baserCMS: Public Web API mail-form submission bypasses image CAPTCHA Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-115479 New | 5.3 | Oct 23 | baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients Affected: >= 5.2.5, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-30878 | 5.3 | Mar 31 | baserCMS: Mail Form Acceptance Bypass via Public API Affected: < 5.2.3 |
Showing 25