Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
49 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Recommended action: Upgrade to 3.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Recommended action: Upgrade to 3.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 3.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
Recommended action: Upgrade to 4.1.1 or 3.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploadercategories/edit URI.
Recommended action: Upgrade to 4.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Recommended action: Upgrade to 4.0.6 or 3.0.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.
Recommended action: Upgrade to 4.1.1 or 3.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
Recommended action: Upgrade to 4.1.1 or 3.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being used in the mail form.
Recommended action: Upgrade to 4.0.6 or 3.0.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/themeconfigs/form data[ThemeConfig][logo] parameter.
Recommended action: Upgrade to 4.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.
Recommended action: Upgrade to 3.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.
Recommended action: Upgrade to 1.6.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is an OS Command Injection Vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible. Target baserCMS 4.5.3 and earlier versions Vulnerability OS Command Injection Vulnerability. Countermeasures Update to the latest version of baserCMS Credits Akagi Yusuke @NTT-ME
Recommended action: Upgrade to 4.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a OS Command Injection Vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible. Target baserCMS 4.5.3 and earlier versions Vulnerability OS Command Injection Vulnerability. Countermeasures Update to the latest version of baserCMS Credits Daniele Scanu @SoterItSecurity
Recommended action: Upgrade to 4.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a cross-site scripting vulnerability in file upload on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible. Target baserCMS 4.5.1 and earlier versions Vulnerability Execution of malicious JavaScript code may alter the display of the page or leak cookie information. Countermeasures Update to the latest version of baserCMS Please refer to the next page for details. https://basercms.net/security/JVN14134801
Recommended action: Upgrade to 4.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Recommended action: Upgrade to 4.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via upload of malicious plugins.
Recommended action: Upgrade to 4.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Recommended action: Upgrade to 4.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS). Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: Edit feed settings, Edit widget area, Sub site new registration, New category registration Tested baserCMS Version : 4.4.0 (Latest) Affected baserCMS Version : 4.0.0 ~ 4.4.0 Patches : https://basercms.net/security/20201029 Found by Aquilao Null
Recommended action: Upgrade to 4.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS). Impact: XSS via Arbitrary script execution. Components are: Blog comment posting Tested baserCMS Version : 4.4.0 (Latest) Affected baserCMS Version : 4.0.0 ~ 4.4.0 Patches : https://basercms.net/security/20201029 Found by yama
Recommended action: Upgrade to 4.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE). Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: Edit template. Tested baserCMS Version : 4.4.0 (Latest) Affected baserCMS Version : 4.0.0 ~ 4.4.0 Patches : https://basercms.net/security/20201029 Found by Aquilao Null
Recommended action: Upgrade to 4.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). Impact: XSS to RCE via Arbitrary file upload. Attack vector is: Administrator must be logged in. Components are: ThemeFilesController.php, UploaderFilesController.php. Tested baserCMS Version : 4.3.6 (Latest) Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE) Patches : https://basercms.net/security/20200827 Found by Vulnerability Research team in Flatt Security Inc.
Recommended action: Upgrade to 4.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.
Recommended action: Upgrade to 4.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS). Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js Tested baserCMS Version : 4.3.6 (Latest) Affected baserCMS Version : 4.0.0 ~ 4.3.6 Patches : https://basercms.net/security/20200827 Found by Aquilao Null
Recommended action: Upgrade to 4.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.