Basecamp
7 CVEs across 4 Basecamp products. Browse Basecamp vulnerabilities, severities, and proof-of-concept exploits.
Basecamp products with known CVEs
Basecamp CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-73428 | Medium | 4.6 | 2026-08-13 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted H… |
CVE-2026-73427 | | | 2026-08-12 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted applic… |
CVE-2025-58067 | Medium | 4.2 | 2025-08-29 | Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "procee… |
CVE-2025-57821 | Medium | 4.2 | 2025-08-27 | Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same orig… |
CVE-2025-46812 | | | 2025-05-08 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious cod… |
CVE-2025-21610 | Medium | 5.3 | 2025-01-03 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting mali… |
CVE-2024-53847 | | | 2024-12-09 | The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. A… |
CVE-2024-43368 | Medium | 6.5 | 2024-08-14 | The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjq… |
CVE-2024-34341 | Medium | 5.4 | 2024-05-07 | Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web o… |
CVE-2023-36612 | High | 7.5 | 2023-06-25 | Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in th… |
CVE-2018-1000855 | Medium | 6.1 | 2018-12-20 | easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS th… |