# cve.now: Baserproject

The newest entries naming Baserproject as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115457](https://cve.now/CVE-2026-115457.md): baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments (CVSS 7.1)
- [CVE-2026-114624](https://cve.now/CVE-2026-114624.md): baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity (CVSS 7.2)
- [CVE-2026-114623](https://cve.now/CVE-2026-114623.md): baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure (CVSS 6.5)
- [CVE-2026-114622](https://cve.now/CVE-2026-114622.md): baserCMS: Encoded path traversal bypass in the theme file API (CVSS 7.2)
- [CVE-2026-114621](https://cve.now/CVE-2026-114621.md): baserCMS: SQL injection in the admin panel and admin API (CVSS 8.8)
- [CVE-2026-115480](https://cve.now/CVE-2026-115480.md): baserCMS: Public Web API mail-form submission bypasses image CAPTCHA (CVSS 5.3)
- [CVE-2026-115479](https://cve.now/CVE-2026-115479.md): baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients (CVSS 5.3)
- [CVE-2026-115481](https://cve.now/CVE-2026-115481.md): baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload (CVSS 8.5)
- [CVE-2026-76635](https://cve.now/CVE-2026-76635.md): baserCMS \< 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php (CVSS 8.6)
- [CVE-2026-32734](https://cve.now/CVE-2026-32734.md): baserCMS: Multiple vulnerabilities in baserCMS (CVSS 7.1)
- [CVE-2026-30879](https://cve.now/CVE-2026-30879.md): baserCMS: Cross-site scripting vulnerability in blog post (CVSS 6.9)
- [CVE-2026-30940](https://cve.now/CVE-2026-30940.md): baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE (CVSS 7.2)
- [CVE-2026-30878](https://cve.now/CVE-2026-30878.md): baserCMS: Mail Form Acceptance Bypass via Public API (CVSS 5.3)
- [CVE-2026-30877](https://cve.now/CVE-2026-30877.md): baserCMS: OS Command Injection in the baserCMS Update Functionality (CVSS 9.1)
- [CVE-2026-30880](https://cve.now/CVE-2026-30880.md): baserCMS: OS command injection vulnerability in installer (CVSS 9.2)
- [CVE-2026-27697](https://cve.now/CVE-2026-27697.md): baserCMS: SQL injection vulnerability in blog post (CVSS 6.9)
- [CVE-2026-21861](https://cve.now/CVE-2026-21861.md): baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) (CVSS 9.1)
- [CVE-2025-32957](https://cve.now/CVE-2025-32957.md): baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) (CVSS 8.7)
- [CVE-2024-46998](https://cve.now/CVE-2024-46998.md): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature (CVSS 7.1)
- [CVE-2024-46996](https://cve.now/CVE-2024-46996.md): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature (CVSS 6.3)
- [CVE-2024-46995](https://cve.now/CVE-2024-46995.md): baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request (CVSS 6.1)
- [CVE-2024-46994](https://cve.now/CVE-2024-46994.md): baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature (CVSS 5.4)
- [CVE-2024-26128](https://cve.now/CVE-2024-26128.md): baserCMS Cross-site Scripting vulnerability in Content Management (CVSS 5.4)
- [CVE-2023-51450](https://cve.now/CVE-2023-51450.md): baserCMS OS command injection vulnerability in Installer (CVSS 5.6)
- [CVE-2023-44379](https://cve.now/CVE-2023-44379.md): baserCMS Cross-site Scripting vulnerability in Site search Feature (CVSS 6.1)
- [CVE-2023-43792](https://cve.now/CVE-2023-43792.md): baserCMS Code Injection Vulnerability in Mail Form Feature (CVSS 5.3)
- [CVE-2023-43649](https://cve.now/CVE-2023-43649.md): baserCMS CSRF vulnerability in Content preview Feature (CVSS 4.7)
- [CVE-2023-43648](https://cve.now/CVE-2023-43648.md): baserCMS Directory Traversal vulnerability in Form submission data management Feature (CVSS 4.9)
- [CVE-2023-43647](https://cve.now/CVE-2023-43647.md): baserCMS Cross-site Scripting vulnerability in File upload Feature (CVSS 6.1)
- [CVE-2023-29009](https://cve.now/CVE-2023-29009.md): basercms XSS Vulnerability via Favorites Feature (CVSS 6.1)
- [CVE-2023-25655](https://cve.now/CVE-2023-25655.md): baserCMS allows any file to be uploaded (CVSS 9.8)
- [CVE-2023-25654](https://cve.now/CVE-2023-25654.md): baserCMS File Uploader Remote Code Execution (RCE) vulnerability (CVSS 9.8)
- [CVE-2022-39325](https://cve.now/CVE-2022-39325.md): Cross-site scripting vulnerability in BaserCMS (CVSS 4.6)
- [CVE-2021-41279](https://cve.now/CVE-2021-41279.md): Zip Slip Vulnerability in BaserCMS (CVSS 7.7)
- [CVE-2021-41243](https://cve.now/CVE-2021-41243.md): OS Command Injection Vulnerability and Potential Zip Slip Vulnerability (CVSS 9.1)
- [CVE-2021-39136](https://cve.now/CVE-2021-39136.md): Cross-site scripting vulnerability in file upload (CVSS 8.7)
- [CVE-2020-15273](https://cve.now/CVE-2020-15273.md): Cross-Site Scripting in baserCMS (CVSS 7.3)
- [CVE-2020-15276](https://cve.now/CVE-2020-15276.md): Cross Site Scripting in baserCMS (CVSS 7.7)
- [CVE-2020-15277](https://cve.now/CVE-2020-15277.md): Remote Code Execution in baserCMS (CVSS 7.2)
- [CVE-2020-15159](https://cve.now/CVE-2020-15159.md): Cross Site Scripting leading to RCE in baserCMS (CVSS 7.6)
- [CVE-2020-15155](https://cve.now/CVE-2020-15155.md): Cross-Site Scripting in baserCMS (CVSS 7.3)
- [CVE-2020-15154](https://cve.now/CVE-2020-15154.md): Cross Site Scripting in baserCMS (CVSS 7.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/baserproject
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.