What is CVE-2026-114621?

CVE-2026-114621 is a high-severity vulnerability in Baserproject Basercms, classified under SQL Injection. CVSS score: 8.8/10. Published 2026-10-23.

How severe is CVE-2026-114621?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Baserproject Basercms

CVE-2026-114621

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.

Vulnerability class: SQL Injection

Published 2026-10-23 · last modified 2026-10-23.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Baserproject Basercms — versions >= 5.0.0, < 5.3.2, >= 5.4.0, < 5.4.2

Weakness classification (CWE)

CWE-89 — SQL Injection

References

Frequently asked questions

What is CVE-2026-114621?: CVE-2026-114621 is a high-severity vulnerability in Baserproject Basercms, classified under SQL Injection. CVSS score: 8.8/10. Published 2026-10-23.
How severe is CVE-2026-114621?: High severity. CVSS v3 base score is 8.8 out of 10.