- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 56 · 6 critical, 12 high, 17 medium
- Registry
- Packagist
Advisories 56
- CVE-2026-32734High 7.1
baserCMS: Multiple vulnerabilities in baserCMS
Affected: fixed in 5.2.3.
- CVE-2026-30879Medium 6.9
baserCMS: Cross-site scripting vulnerability in blog post
Affected: fixed in 5.2.3.
- CVE-2026-30940High 7.2
baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE
Affected: fixed in 5.2.3.
- CVE-2026-30878Medium 5.3
baserCMS: Mail Form Acceptance Bypass via Public API
Affected: fixed in 5.2.3.
- CVE-2026-30877Critical 9.1
baserCMS: OS Command Injection in the baserCMS Update Functionality
Affected: fixed in 5.2.3.
- CVE-2026-30880Critical 9.2
baserCMS: OS command injection vulnerability in installer
Affected: fixed in 5.2.3.
- CVE-2026-27697Medium 6.9
baserCMS: SQL injection vulnerability in blog post
Affected: fixed in 5.2.3.
- CVE-2026-21861Critical 9.1
baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)
Affected: fixed in 5.2.3.
- CVE-2025-32957High 8.7
baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)
Affected: fixed in 5.2.3.
- CVE-2024-46998High 7.1
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature
Affected: fixed in 5.1.2.
- CVE-2024-46996Medium 6.3
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature
Affected: fixed in 5.1.2.
- CVE-2024-46995Medium 6.1
baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request
Affected: fixed in 5.1.2.
- CVE-2024-46994Medium 5.4
baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature
Affected: fixed in 5.1.2.
- CVE-2024-26128Medium 5.4
baserCMS Cross-site Scripting vulnerability in Content Management
Affected: fixed in 5.0.9.
- CVE-2023-51450Medium 5.6
baserCMS OS command injection vulnerability in Installer
Affected: fixed in 5.0.9.
Show all 56 advisoriesShow fewer advisories
- CVE-2023-44379Medium 6.1
baserCMS Cross-site Scripting vulnerability in Site search Feature
Affected: fixed in 5.0.9.
- CVE-2023-43792Medium 5.3
baserCMS Code Injection Vulnerability in Mail Form Feature
Affected: from 4.6.0, through 4.7.6.
- CVE-2023-43649Medium 4.7
baserCMS CSRF vulnerability in Content preview Feature
Affected: fixed in 4.8.0.
- CVE-2023-43648Medium 4.9
baserCMS Directory Traversal vulnerability in Form submission data management Feature
Affected: fixed in 4.8.0.
- CVE-2023-43647Medium 6.1
baserCMS Cross-site Scripting vulnerability in File upload Feature
Affected: fixed in 4.8.0.
- CVE-2023-29009Medium 6.1
basercms XSS Vulnerability via Favorites Feature
Affected: fixed in 4.8.0.
- CVE-2023-25655Critical 9.8
baserCMS allows any file to be uploaded
Affected: fixed in 4.7.5.
- CVE-2023-25654Critical 9.8
baserCMS File Uploader Remote Code Execution (RCE) vulnerability
Affected: fixed in 4.7.5.
- CVE-2022-42486Medium 4.8
Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated…
Affected: fixed in 4.7.2.
- CVE-2022-41994Medium 4.8
Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated…
Affected: fixed in 4.7.2.
- CVE-2022-39325Medium 4.6
Cross-site scripting vulnerability in BaserCMS
Affected: fixed in 4.7.2.
- CVE-2021-41279High 7.7
Zip Slip Vulnerability in BaserCMS
Affected: fixed in 4.5.4.
- CVE-2021-41243Critical 9.1
OS Command Injection Vulnerability and Potential Zip Slip Vulnerability
Affected: fixed in 4.5.4.
- CVE-2021-39136High 8.7
Cross-site scripting vulnerability in file upload
Affected: fixed in 4.5.1.
- CVE-2021-20683Unrated
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote…
Affected: fixed in 4.4.5.
- CVE-2021-20682Unrated
baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via…
Affected: fixed in 4.4.5.
- CVE-2021-20681Unrated
Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated…
Affected: fixed in 4.4.5.
- CVE-2020-15273High 7.3
Cross-Site Scripting in baserCMS
Affected: from 4.4.0, fixed in 4.4.1.
- CVE-2020-15276High 7.7
Cross Site Scripting in baserCMS
Affected: from 4.4.0, fixed in 4.4.1.
- CVE-2020-15277High 7.2
Remote Code Execution in baserCMS
Affected: from 4.4.0, fixed in 4.4.1.
- CVE-2020-15159High 7.6
Cross Site Scripting leading to RCE in baserCMS
Affected: from 4.0.0, fixed in 4.3.7.
- CVE-2020-15155High 7.3
Cross-Site Scripting in baserCMS
Affected: from 4.0.0, fixed in 4.3.7.
- CVE-2020-15154High 7.3
Cross Site Scripting in baserCMS
Affected: from 4.0.0, fixed in 4.3.7.
- CVE-2018-18943Unrated
An issue was discovered in baserCMS before 4.1.4.
Affected: fixed in 4.1.4.
- CVE-2018-18942Unrated
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the…
Affected: fixed in 4.1.4.
- CVE-2018-0575Unrated
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access…
Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.
- CVE-2018-0574Unrated
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote…
Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.
- CVE-2018-0573Unrated
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access…
Affected: fixed in 3.0.16; from 4.0.0, fixed in 4.1.1.
- CVE-2018-0572Unrated
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass…
Affected: from 4.0.0, fixed in 4.1.1; fixed in 3.0.16.
- CVE-2018-0571Unrated
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator…
Affected: from 4.0.0, fixed in 4.1.1; fixed in 3.0.16.
- CVE-2018-0570Unrated
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote…
Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.
- CVE-2018-0569Unrated
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute…
Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.
- CVE-2017-10844Unrated
baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.
Affected: through 3.0.14; from 4.0.0, through 4.0.5.
- CVE-2017-10843Unrated
baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the…
Affected: fixed in 3.0.15; from 4.0.0, fixed in 4.0.6.
- CVE-2017-10842Unrated
SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL…
Affected: fixed in 3.0.15; from 4.0.0, fixed in 4.0.6.
- CVE-2016-4881Unrated
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the…
Affected: fixed in 3.0.11.
- CVE-2016-4880Unrated
Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject…
Affected: fixed in 3.0.11.
- CVE-2016-4879Unrated
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the…
Affected: through 3.0.10.
- CVE-2016-4878Unrated
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the…
Affected: fixed in 3.0.11.
- CVE-2015-5640Unrated
baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.
Affected: fixed in 3.0.8.
- CVE-2011-2674Unrated
BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated…
Affected: fixed in 1.6.12.