CVE-2026-32734 | High | 7.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched i… |
CVE-2026-30940 | High | 7.2 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/b… |
CVE-2026-30880 | Critical | 9.8 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been p… |
CVE-2026-30879 | Medium | 6.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patch… |
CVE-2026-30878 | Medium | 5.3 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even… |
CVE-2026-30877 | Critical | 9.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this is… |
CVE-2026-27697 | Critical | 9.8 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in v… |
CVE-2026-21861 | Critical | 9.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality… |
CVE-2025-32957 | High | 8.7 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then autom… |
CVE-2024-46998 | High | 7.1 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Edit Email Form Settings Feature. Version… |
CVE-2024-46996 | Medium | 6.3 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Blog posts feature. Version 5.1.2 fixes t… |
CVE-2024-46995 | Medium | 6.1 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes thi… |
CVE-2024-46994 | Medium | 5.4 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in Blog posts and Contents list Feature. Version… |
CVE-2024-26128 | Medium | 5.4 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5… |
CVE-2023-51450 | Medium | 5.6 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Ver… |
CVE-2023-44379 | Medium | 6.1 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 co… |
CVE-2023-43792 | Critical | 9.8 | 2023-10-30 | baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time… |
CVE-2023-43649 | Medium | 4.7 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of base… |
CVE-2023-43648 | Medium | 4.9 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management featur… |
CVE-2023-43647 | Medium | 6.1 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Vers… |
CVE-2023-29009 | Medium | 6.1 | 2023-10-27 | baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This iss… |
CVE-2023-25655 | Critical | 9.8 | 2023-03-23 | baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch. |
CVE-2023-25654 | Critical | 9.8 | 2023-03-23 | baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Ver… |
CVE-2022-42486 | Medium | 4.8 | 2022-12-07 | Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administr… |
CVE-2022-41994 | Medium | 4.8 | 2022-12-07 | Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrat… |
CVE-2022-39325 | Medium | 4.6 | 2022-11-25 | BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management sy… |
CVE-2021-41279 | High | 7.7 | 2021-11-26 | BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload cra… |
CVE-2021-41243 | Critical | 9.1 | 2021-11-26 | There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files… |
CVE-2021-39136 | High | 8.7 | 2021-08-25 | baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerabil… |
CVE-2021-20683 | Medium | 5.4 | 2021-03-26 | Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to i… |
CVE-2021-20682 | High | 7.2 | 2021-03-26 | baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors. |
CVE-2021-20681 | Medium | 5.4 | 2021-03-26 | Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an… |
CVE-2020-15276 | High | 7.7 | 2020-10-30 | baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The… |
CVE-2020-15273 | High | 7.3 | 2020-10-30 | baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site… |
CVE-2020-15277 | High | 7.2 | 2020-10-30 | baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executa… |
CVE-2020-15159 | High | 7.6 | 2020-08-28 | baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administra… |
CVE-2020-15155 | High | 7.3 | 2020-08-28 | baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. Th… |
CVE-2020-15154 | High | 7.3 | 2020-08-28 | baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. Th… |
CVE-2018-18943 | Medium | 4.8 | 2018-11-05 | An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[U… |
CVE-2018-18942 | High | 7.2 | 2018-11-05 | In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConf… |
CVE-2018-0575 | Medium | 5.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to vie… |
CVE-2018-0574 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject… |
CVE-2018-0573 | Medium | 5.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to vi… |
CVE-2018-0572 | High | 8.1 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to vi… |
CVE-2018-0571 | Medium | 4.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitra… |
CVE-2018-0570 | Medium | 5.4 | 2018-06-26 | Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attack… |
CVE-2018-0569 | High | 8.8 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands v… |
CVE-2017-10844 | High | 8.8 | 2017-08-29 | baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors. |
CVE-2017-10843 | High | 7.5 | 2017-08-29 | baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being… |
CVE-2017-10842 | Critical | 9.8 | 2017-08-29 | SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vec… |
CVE-2016-4887 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the authentication of… |
CVE-2016-4886 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4885 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4884 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4883 | Medium | 5.4 | 2017-05-12 | Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vector… |
CVE-2016-4882 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators v… |
CVE-2016-4881 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4880 | Medium | 5.4 | 2017-05-12 | Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or H… |
CVE-2016-4879 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of admi… |
CVE-2016-4878 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators v… |
CVE-2016-4877 | Medium | 5.4 | 2017-05-12 | Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or H… |
CVE-2016-4876 | High | 8.8 | 2017-05-12 | Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators t… |
CVE-2015-7769 | Medium | 6.3 | 2016-02-19 | baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors. |
CVE-2015-5641 | | | 2015-10-06 | SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. |
CVE-2015-5640 | | | 2015-10-06 | baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request. |
CVE-2012-1248 | | | 2012-05-15 | app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hija… |
CVE-2011-2674 | | | 2011-10-02 | BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privilege… |
CVE-2011-2673 | | | 2011-10-02 | Cross-site scripting (XSS) vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |