Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vqx2-hzju-r7et
Vulnerability ID VCID-vqx2-hzju-r7et
Aliases CVE-2020-15155
GHSA-4r3m-j6x5-48m3
Summary Cross-site Scripting baserCMS is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is `toolbar.php`.
Status Published
Exploitability 0.5
Weighted Severity 6.6
Risk 3.3
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00868 https://api.first.org/data/v1/epss?cve=CVE-2020-15155
cvssv3.1 7.3 https://basercms.net/security/20200827
generic_textual LOW https://basercms.net/security/20200827
cvssv3.1 7.3 https://github.com/baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f
generic_textual LOW https://github.com/baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f
cvssv3.1 7.3 https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3
generic_textual LOW https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3
cvssv3.1 7.3 https://nvd.nist.gov/vuln/detail/CVE-2020-15155
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2020-15155
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-15155
https://basercms.net/security/20200827
https://github.com/baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f
https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3
CVE-2020-15155 https://nvd.nist.gov/vuln/detail/CVE-2020-15155
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N Found at https://basercms.net/security/20200827
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-15155
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.75527
EPSS Score 0.00868
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:20:11.635486+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/baserproject/basercms/CVE-2020-15155.yml 38.6.0