BA
Product
basercms
18
CVEs
0
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 2High 10Medium 6Low 0
Watch
Add basercms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-114621 New | 8.8 | Oct 23 | baserCMS: SQL injection in the admin panel and admin API Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-115481 New | 8.5 | Oct 23 | baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload Affected: >= 5.0.0-beta1, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-114624 New | 7.2 | Oct 23 | baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-114622 New | 7.2 | Oct 23 | baserCMS: Encoded path traversal bypass in the theme file API Affected: >= 5.2.3, < 5.3.2; >= 5.4.0, < 5.4.2 |
| CVE-2026-76635 | 7.2 | Aug 20 | baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php Affected: before 5.3.0 |
| CVE-2026-30940 | 7.2 | Mar 31 | baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE Affected: < 5.2.3 |
| CVE-2026-30877 | 7.2 | Mar 31 | baserCMS: OS Command Injection in the baserCMS Update Functionality Affected: < 5.2.3 |
| CVE-2026-21861 | 7.2 | Mar 31 | baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) Affected: < 5.2.3 |
| CVE-2025-32957 | 7.2 | Mar 31 | baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) Affected: < 5.2.3 |
| CVE-2026-115457 New | 7.1 | Oct 23 | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments Affected: >= 5.0.0, < 5.3.2; >= 5.4.0, < 5.4.2 |
Showing 10