Advisories · Technology
baserproject basercms.
Every CVE that names baserproject basercms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments
- baserproject basercms
- Cross-site scripting (XSS)
- CVSS 7.2 High
baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
- baserproject basercms
- Insecure deserialization
- CVSS 6.5 Medium
baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure
- baserproject basercms
- Path traversal
- Information disclosure
- CVSS 7.2 High
baserCMS: Encoded path traversal bypass in the theme file API
- baserproject basercms
- Path traversal
- CWE-180
- CVSS 8.8 High
baserCMS: SQL injection in the admin panel and admin API
- baserproject basercms
- SQL injection
- CVSS 5.3 Medium
baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
- baserproject basercms
- CWE-693
- CWE-799
- CVSS 5.3 Medium
baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients
- baserproject basercms
- CWE-20
- CVSS 8.5 High
baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
- baserproject basercms
- Unrestricted file upload
- CVSS 8.6 High
baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php
- baserproject basercms
- SQL injection
- Code injection