Search for packages
| purl | pkg:composer/baserproject/basercms@3.0.22 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1nef-kbvb-nqgv
Aliases: CVE-2026-21861 GHSA-qxmc-6f24-g86g |
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-2c9a-4k3v-1ydj
Aliases: CVE-2023-25655 GHSA-mfvg-qwcw-qvc8 |
baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch. |
Affected by 21 other vulnerabilities. |
|
VCID-3btn-6dkf-67aq
Aliases: CVE-2023-43647 GHSA-ggj4-78rm-6xgv |
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue. |
Affected by 16 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-3jx2-hpuj-afaf
Aliases: CVE-2023-25654 GHSA-h4cc-fxpp-pgw9 |
baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch. |
Affected by 21 other vulnerabilities. |
|
VCID-46uc-rvvt-5ke8
Aliases: CVE-2023-43648 GHSA-hmqj-gv2m-hq55 |
baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue. |
Affected by 16 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-686s-gr1n-4qa9
Aliases: CVE-2024-46995 GHSA-mr7q-fv7j-jcgv |
baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes this issue. |
Affected by 9 other vulnerabilities. |
|
VCID-6p1v-g9d1-zfe5
Aliases: CVE-2026-30880 GHSA-6hpg-8rx3-cwgv |
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-7rv4-k7qe-vyds
Aliases: CVE-2023-29009 GHSA-8vqx-prq4-rqrq |
baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0. |
Affected by 16 other vulnerabilities. Affected by 16 other vulnerabilities. |
|
VCID-c77m-9mgg-c3ht
Aliases: CVE-2024-46996 GHSA-66jv-qrm3-vvfg |
baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Blog posts feature. Version 5.1.2 fixes this issue. |
Affected by 9 other vulnerabilities. |
|
VCID-cknd-kv9u-sfdc
Aliases: CVE-2023-51450 GHSA-77fc-4cv5-hmfr |
baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability. |
Affected by 13 other vulnerabilities. |
|
VCID-cprt-rzws-tkgh
Aliases: CVE-2026-32734 GHSA-677c-xv24-crgx |
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-cyb9-u781-tkar
Aliases: CVE-2026-27697 GHSA-vh89-rjph-2g7p |
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-e1dn-at7q-t7fj
Aliases: CVE-2026-30879 GHSA-jmq3-x8q7-j9qm |
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-e7n8-hhe7-5qhp
Aliases: CVE-2023-43649 GHSA-fw9x-cqjq-7jx5 |
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue. |
Affected by 16 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-f1qc-b1uy-uycf
Aliases: CVE-2026-30877 GHSA-m9g7-rgfc-jcm7 |
baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-mkbe-t5bg-a3fz
Aliases: CVE-2025-32957 GHSA-hv78-cwp4-8r7r |
baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-mnc6-6egy-jbhn
Aliases: CVE-2026-30878 GHSA-8cr7-r8qw-gp3c |
baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-pfj6-r4pn-wfhf
Aliases: CVE-2024-46998 GHSA-p3m2-mj3j-j49x |
baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Edit Email Form Settings Feature. Version 5.1.2 fixes the issue. |
Affected by 9 other vulnerabilities. |
|
VCID-py24-kt42-9kdy
Aliases: CVE-2026-30940 GHSA-c5c6-37vq-pjcq |
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3. |
Affected by 0 other vulnerabilities. |
|
VCID-qv2s-xgym-v3bv
Aliases: CVE-2024-46994 GHSA-wrjc-fmfq-w3jr |
baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in Blog posts and Contents list Feature. Version 5.1.2 fixes this issue. |
Affected by 9 other vulnerabilities. |
|
VCID-wgd1-9jtr-vfgj
Aliases: CVE-2024-26128 GHSA-jjxq-m8h3-4vw5 |
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5.0.9 contains a fix for this vulnerability. |
Affected by 13 other vulnerabilities. |
|
VCID-ygym-64en-vbav
Aliases: CVE-2023-44379 GHSA-66c2-p8rh-qx87 |
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability. |
Affected by 13 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||