Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p6nr-eu91-53b4
Vulnerability ID VCID-p6nr-eu91-53b4
Aliases CVE-2020-15159
GHSA-673x-f5wx-fxpw
Summary Cross-site Scripting baserCMS is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The affected components are `ThemeFilesController.php` and `UploaderFilesController.php`.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01563 https://api.first.org/data/v1/epss?cve=CVE-2020-15159
cvssv3.1 7.6 https://basercms.net/security/20200827
generic_textual LOW https://basercms.net/security/20200827
cvssv3.1 7.6 https://github.com/baserproject/basercms/commit/16a7b3cd09a0ca355474119c76897eac2034a66d
generic_textual LOW https://github.com/baserproject/basercms/commit/16a7b3cd09a0ca355474119c76897eac2034a66d
cvssv3.1 7.6 https://github.com/baserproject/basercms/security/advisories/GHSA-673x-f5wx-fxpw
generic_textual LOW https://github.com/baserproject/basercms/security/advisories/GHSA-673x-f5wx-fxpw
cvssv3.1 7.6 https://nvd.nist.gov/vuln/detail/CVE-2020-15159
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2020-15159
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-15159
https://basercms.net/security/20200827
https://github.com/baserproject/basercms/commit/16a7b3cd09a0ca355474119c76897eac2034a66d
https://github.com/baserproject/basercms/security/advisories/GHSA-673x-f5wx-fxpw
CVE-2020-15159 https://nvd.nist.gov/vuln/detail/CVE-2020-15159
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://basercms.net/security/20200827
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/baserproject/basercms/commit/16a7b3cd09a0ca355474119c76897eac2034a66d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/baserproject/basercms/security/advisories/GHSA-673x-f5wx-fxpw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-15159
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.81826
EPSS Score 0.01563
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:20:11.599198+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/baserproject/basercms/CVE-2020-15159.yml 38.6.0