# baserproject/basercms (Packagist) vulnerabilities

56 known vulnerabilities (6 critical, 12 high, 17 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/baserproject/basercms

## Advisories (56)

### [CVE-2026-32734](https://cve.now/CVE-2026-32734): baserCMS: Multiple vulnerabilities in baserCMS

- Severity: High 7.1
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2026-30879](https://cve.now/CVE-2026-30879): baserCMS: Cross-site scripting vulnerability in blog post

- Severity: Medium 6.9
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2026-30940](https://cve.now/CVE-2026-30940): baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE

- Severity: High 7.2
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2026-30878](https://cve.now/CVE-2026-30878): baserCMS: Mail Form Acceptance Bypass via Public API

- Severity: Medium 5.3
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2026-30877](https://cve.now/CVE-2026-30877): baserCMS: OS Command Injection in the baserCMS Update Functionality

- Severity: Critical 9.1
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2026-30880](https://cve.now/CVE-2026-30880): baserCMS: OS command injection vulnerability in installer

- Severity: Critical 9.2
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2026-27697](https://cve.now/CVE-2026-27697): baserCMS: SQL injection vulnerability in blog post

- Severity: Medium 6.9
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2026-21861](https://cve.now/CVE-2026-21861): baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

- Severity: Critical 9.1
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2025-32957](https://cve.now/CVE-2025-32957): baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)

- Severity: High 8.7
- Published: Mar 31, 2026
- Affected: fixed in 5.2.3.

### [CVE-2024-46998](https://cve.now/CVE-2024-46998): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature

- Severity: High 7.1
- Published: Oct 24, 2024
- Affected: fixed in 5.1.2.

### [CVE-2024-46996](https://cve.now/CVE-2024-46996): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature

- Severity: Medium 6.3
- Published: Oct 24, 2024
- Affected: fixed in 5.1.2.

### [CVE-2024-46995](https://cve.now/CVE-2024-46995): baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request

- Severity: Medium 6.1
- Published: Oct 24, 2024
- Affected: fixed in 5.1.2.

### [CVE-2024-46994](https://cve.now/CVE-2024-46994): baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature

- Severity: Medium 5.4
- Published: Oct 24, 2024
- Affected: fixed in 5.1.2.

### [CVE-2024-26128](https://cve.now/CVE-2024-26128): baserCMS Cross-site Scripting vulnerability in Content Management

- Severity: Medium 5.4
- Published: Feb 22, 2024
- Affected: fixed in 5.0.9.

### [CVE-2023-51450](https://cve.now/CVE-2023-51450): baserCMS OS command injection vulnerability in Installer

- Severity: Medium 5.6
- Published: Feb 22, 2024
- Affected: fixed in 5.0.9.

### [CVE-2023-44379](https://cve.now/CVE-2023-44379): baserCMS Cross-site Scripting vulnerability in Site search Feature

- Severity: Medium 6.1
- Published: Feb 22, 2024
- Affected: fixed in 5.0.9.

### [CVE-2023-43792](https://cve.now/CVE-2023-43792): baserCMS Code Injection Vulnerability in Mail Form Feature

- Severity: Medium 5.3
- Published: Oct 30, 2023
- Affected: from 4.6.0, through 4.7.6.

### [CVE-2023-43649](https://cve.now/CVE-2023-43649): baserCMS CSRF vulnerability in Content preview Feature

- Severity: Medium 4.7
- Published: Oct 30, 2023
- Affected: fixed in 4.8.0.

### [CVE-2023-43648](https://cve.now/CVE-2023-43648): baserCMS Directory Traversal vulnerability in Form submission data management Feature

- Severity: Medium 4.9
- Published: Oct 30, 2023
- Affected: fixed in 4.8.0.

### [CVE-2023-43647](https://cve.now/CVE-2023-43647): baserCMS Cross-site Scripting vulnerability in File upload Feature

- Severity: Medium 6.1
- Published: Oct 30, 2023
- Affected: fixed in 4.8.0.

### [CVE-2023-29009](https://cve.now/CVE-2023-29009): basercms XSS Vulnerability via Favorites Feature

- Severity: Medium 6.1
- Published: Oct 27, 2023
- Affected: fixed in 4.8.0.

### [CVE-2023-25655](https://cve.now/CVE-2023-25655): baserCMS allows any file to be uploaded

- Severity: Critical 9.8
- Published: Mar 23, 2023
- Affected: fixed in 4.7.5.

### [CVE-2023-25654](https://cve.now/CVE-2023-25654): baserCMS File Uploader Remote Code Execution (RCE) vulnerability

- Severity: Critical 9.8
- Published: Mar 23, 2023
- Affected: fixed in 4.7.5.

### [CVE-2022-42486](https://cve.now/CVE-2022-42486): Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated…

- Severity: Medium 4.8
- Published: Dec 7, 2022
- Affected: fixed in 4.7.2.

### [CVE-2022-41994](https://cve.now/CVE-2022-41994): Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated…

- Severity: Medium 4.8
- Published: Dec 7, 2022
- Affected: fixed in 4.7.2.

### [CVE-2022-39325](https://cve.now/CVE-2022-39325): Cross-site scripting vulnerability in BaserCMS

- Severity: Medium 4.6
- Published: Nov 25, 2022
- Affected: fixed in 4.7.2.

### [CVE-2021-41279](https://cve.now/CVE-2021-41279): Zip Slip Vulnerability in BaserCMS

- Severity: High 7.7
- Published: Nov 26, 2021
- Affected: fixed in 4.5.4.

### [CVE-2021-41243](https://cve.now/CVE-2021-41243): OS Command Injection Vulnerability and Potential Zip Slip Vulnerability

- Severity: Critical 9.1
- Published: Nov 26, 2021
- Affected: fixed in 4.5.4.

### [CVE-2021-39136](https://cve.now/CVE-2021-39136): Cross-site scripting vulnerability in file upload

- Severity: High 8.7
- Published: Aug 25, 2021
- Affected: fixed in 4.5.1.

### [CVE-2021-20683](https://cve.now/CVE-2021-20683): Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote…

- Severity: Unrated
- Published: Mar 26, 2021
- Affected: fixed in 4.4.5.

### [CVE-2021-20682](https://cve.now/CVE-2021-20682): baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via…

- Severity: Unrated
- Published: Mar 26, 2021
- Affected: fixed in 4.4.5.

### [CVE-2021-20681](https://cve.now/CVE-2021-20681): Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated…

- Severity: Unrated
- Published: Mar 26, 2021
- Affected: fixed in 4.4.5.

### [CVE-2020-15273](https://cve.now/CVE-2020-15273): Cross-Site Scripting in baserCMS

- Severity: High 7.3
- Published: Oct 30, 2020
- Affected: from 4.4.0, fixed in 4.4.1.

### [CVE-2020-15276](https://cve.now/CVE-2020-15276): Cross Site Scripting in baserCMS

- Severity: High 7.7
- Published: Oct 30, 2020
- Affected: from 4.4.0, fixed in 4.4.1.

### [CVE-2020-15277](https://cve.now/CVE-2020-15277): Remote Code Execution in baserCMS

- Severity: High 7.2
- Published: Oct 30, 2020
- Affected: from 4.4.0, fixed in 4.4.1.

### [CVE-2020-15159](https://cve.now/CVE-2020-15159): Cross Site Scripting leading to RCE in baserCMS

- Severity: High 7.6
- Published: Aug 28, 2020
- Affected: from 4.0.0, fixed in 4.3.7.

### [CVE-2020-15155](https://cve.now/CVE-2020-15155): Cross-Site Scripting in baserCMS

- Severity: High 7.3
- Published: Aug 28, 2020
- Affected: from 4.0.0, fixed in 4.3.7.

### [CVE-2020-15154](https://cve.now/CVE-2020-15154): Cross Site Scripting in baserCMS

- Severity: High 7.3
- Published: Aug 28, 2020
- Affected: from 4.0.0, fixed in 4.3.7.

### [CVE-2018-18943](https://cve.now/CVE-2018-18943): An issue was discovered in baserCMS before 4.1.4.

- Severity: Unrated
- Published: Nov 5, 2018
- Affected: fixed in 4.1.4.

### [CVE-2018-18942](https://cve.now/CVE-2018-18942): In baserCMS before 4.1.4, lib\\Baser\\Model\\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the…

- Severity: Unrated
- Published: Nov 5, 2018
- Affected: fixed in 4.1.4.

### [CVE-2018-0575](https://cve.now/CVE-2018-0575): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access…

- Severity: Unrated
- Published: Jun 26, 2018
- Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.

### [CVE-2018-0574](https://cve.now/CVE-2018-0574): Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote…

- Severity: Unrated
- Published: Jun 26, 2018
- Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.

### [CVE-2018-0573](https://cve.now/CVE-2018-0573): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access…

- Severity: Unrated
- Published: Jun 26, 2018
- Affected: fixed in 3.0.16; from 4.0.0, fixed in 4.1.1.

### [CVE-2018-0572](https://cve.now/CVE-2018-0572): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass…

- Severity: Unrated
- Published: Jun 26, 2018
- Affected: from 4.0.0, fixed in 4.1.1; fixed in 3.0.16.

### [CVE-2018-0571](https://cve.now/CVE-2018-0571): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator…

- Severity: Unrated
- Published: Jun 26, 2018
- Affected: from 4.0.0, fixed in 4.1.1; fixed in 3.0.16.

### [CVE-2018-0570](https://cve.now/CVE-2018-0570): Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote…

- Severity: Unrated
- Published: Jun 26, 2018
- Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.

### [CVE-2018-0569](https://cve.now/CVE-2018-0569): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute…

- Severity: Unrated
- Published: Jun 26, 2018
- Affected: from 4.0.0, through 4.1.0.1; through 3.0.15.

### [CVE-2017-10844](https://cve.now/CVE-2017-10844): baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.

- Severity: Unrated
- Published: Aug 28, 2017
- Affected: through 3.0.14; from 4.0.0, through 4.0.5.

### [CVE-2017-10843](https://cve.now/CVE-2017-10843): baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the…

- Severity: Unrated
- Published: Aug 28, 2017
- Affected: fixed in 3.0.15; from 4.0.0, fixed in 4.0.6.

### [CVE-2017-10842](https://cve.now/CVE-2017-10842): SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL…

- Severity: Unrated
- Published: Aug 28, 2017
- Affected: fixed in 3.0.15; from 4.0.0, fixed in 4.0.6.

### [CVE-2016-4881](https://cve.now/CVE-2016-4881): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the…

- Severity: Unrated
- Published: May 12, 2017
- Affected: fixed in 3.0.11.

### [CVE-2016-4880](https://cve.now/CVE-2016-4880): Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject…

- Severity: Unrated
- Published: May 12, 2017
- Affected: fixed in 3.0.11.

### [CVE-2016-4879](https://cve.now/CVE-2016-4879): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the…

- Severity: Unrated
- Published: May 12, 2017
- Affected: through 3.0.10.

### [CVE-2016-4878](https://cve.now/CVE-2016-4878): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the…

- Severity: Unrated
- Published: May 12, 2017
- Affected: fixed in 3.0.11.

### [CVE-2015-5640](https://cve.now/CVE-2015-5640): baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.

- Severity: Unrated
- Published: Oct 3, 2015
- Affected: fixed in 3.0.8.

### [CVE-2011-2674](https://cve.now/CVE-2011-2674): BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated…

- Severity: Unrated
- Published: Oct 2, 2011
- Affected: fixed in 1.6.12.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/baserproject/basercms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.