# cve.now: Basercms Users Community

The newest entries naming Basercms Users Community as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97150](https://cve.now/CVE-2026-97150.md): When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP c (CVSS 7.2)
- [CVE-2026-65875](https://cve.now/CVE-2026-65875.md): BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. (CVSS 7.1)
- [CVE-2022-42486](https://cve.now/CVE-2022-42486.md): Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacke (CVSS 4.8)
- [CVE-2022-41994](https://cve.now/CVE-2022-41994.md): Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker (CVSS 4.8)
- [CVE-2021-20683](https://cve.now/CVE-2021-20683.md): Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authentic (no CVSS)
- [CVE-2021-20682](https://cve.now/CVE-2021-20682.md): baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified (no CVSS)
- [CVE-2021-20681](https://cve.now/CVE-2021-20681.md): Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated att (no CVSS)
- [CVE-2018-0575](https://cve.now/CVE-2018-0575.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction (no CVSS)
- [CVE-2018-0574](https://cve.now/CVE-2018-0574.md): Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote a (no CVSS)
- [CVE-2018-0573](https://cve.now/CVE-2018-0573.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction (no CVSS)
- [CVE-2018-0572](https://cve.now/CVE-2018-0572.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass acces (no CVSS)
- [CVE-2018-0571](https://cve.now/CVE-2018-0571.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privileg (no CVSS)
- [CVE-2018-0570](https://cve.now/CVE-2018-0570.md): Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote a (no CVSS)
- [CVE-2018-0569](https://cve.now/CVE-2018-0569.md): baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbi (no CVSS)
- [CVE-2017-10843](https://cve.now/CVE-2017-10843.md): baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "F (no CVSS)
- [CVE-2017-10842](https://cve.now/CVE-2017-10842.md): SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2016-4887](https://cve.now/CVE-2016-4887.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the (no CVSS)
- [CVE-2016-4886](https://cve.now/CVE-2016-4886.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS)
- [CVE-2016-4885](https://cve.now/CVE-2016-4885.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS)
- [CVE-2016-4884](https://cve.now/CVE-2016-4884.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS)
- [CVE-2016-4883](https://cve.now/CVE-2016-4883.md): Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2016-4882](https://cve.now/CVE-2016-4882.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication (no CVSS)
- [CVE-2016-4881](https://cve.now/CVE-2016-4881.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS)
- [CVE-2016-4880](https://cve.now/CVE-2016-4880.md): Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitr (no CVSS)
- [CVE-2016-4879](https://cve.now/CVE-2016-4879.md): Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the aut (no CVSS)
- [CVE-2016-4878](https://cve.now/CVE-2016-4878.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication (no CVSS)
- [CVE-2016-4877](https://cve.now/CVE-2016-4877.md): Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitr (no CVSS)
- [CVE-2016-4876](https://cve.now/CVE-2016-4876.md): Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/basercms-users-community
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.