Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hpk4-a6tr-3ffe
Vulnerability ID VCID-hpk4-a6tr-3ffe
Aliases CVE-2021-39136
GHSA-hgjr-632x-qpp3
Summary baserCMS is an open source content management system with a focus on Japanese language support. A Cross-site Scripting vulnerability has been identified.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
cvssv3.1 8.7 http://jvn.jp/en/jp/JVN14134801/index.html
generic_textual HIGH http://jvn.jp/en/jp/JVN14134801/index.html
epss 0.0054 https://api.first.org/data/v1/epss?cve=CVE-2021-39136
epss 0.0054 https://api.first.org/data/v1/epss?cve=CVE-2021-39136
cvssv3.1 8.7 https://basercms.net/security/JVN_14134801
generic_textual HIGH https://basercms.net/security/JVN_14134801
cvssv3.1 8.7 https://github.com/baserproject/basercms
generic_textual HIGH https://github.com/baserproject/basercms
cvssv3.1 8.7 https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc
generic_textual HIGH https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc
cvssv3.1 8.7 https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3
generic_textual HIGH https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3
cvssv3.1 8.7 https://nvd.nist.gov/vuln/detail/CVE-2021-39136
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-39136
Reference id Reference type URL
http://jvn.jp/en/jp/JVN14134801/index.html
https://api.first.org/data/v1/epss?cve=CVE-2021-39136
https://basercms.net/security/JVN_14134801
https://github.com/baserproject/basercms
https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc
https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3
CVE-2021-39136 https://nvd.nist.gov/vuln/detail/CVE-2021-39136
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Found at http://jvn.jp/en/jp/JVN14134801/index.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://basercms.net/security/JVN_14134801
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/baserproject/basercms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-39136
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.6795
EPSS Score 0.0054
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:39:53.722977+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/baserproject/basercms/CVE-2021-39136.yml 38.6.0