Basercms CVEs — known vulnerabilities

Basercms HIGH 8.7

CVE-2020-15276

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comm…

Fix: 4.4.1+

Fix from $1,950 2020-10-30

Basercms HIGH 8.1

CVE-2020-15273

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area…

Fix: 4.4.1+

Fix from $1,950 2020-10-30

Basercms HIGH 7.2

CVE-2020-15277

baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading …

Fix: 4.4.1+

Fix from $1,950 2020-10-30

Basercms HIGH 7.6

CVE-2020-15159

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system …

Fix: after 4.3.6

Fix from $1,950 2020-08-28

Basercms HIGH 7.3

CVE-2020-15155

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnera…

Fix: after 4.3.6

Fix from $1,950 2020-08-28

Basercms HIGH 7.3

CVE-2020-15154

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnera…

Fix: after 4.3.6

Fix from $1,950 2020-08-28

Basercms HIGH 7.2

CVE-2018-18942

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data…

Fix: 4.1.4+

Fix from $1,950 2018-11-05

Basercms MEDIUM 6.1

CVE-2018-0574

Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers …

Fix: after 4.1.0.1

Fix from $1,600 2018-06-26

Basercms MEDIUM 5.3

CVE-2018-0573

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a con…

Fix: after 4.1.0.1

Fix from $1,600 2018-06-26

Basercms MEDIUM 5.3

CVE-2018-0575

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail f…

Fix: after 4.1.0.1

Fix from $1,600 2018-06-26

Basercms HIGH 8.8

CVE-2018-0569

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS …

Fix: after 4.1.0.1

Fix from $1,950 2018-06-26

Basercms HIGH 8.1

CVE-2018-0572

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restric…

Fix: after 4.1.0.1

Fix from $1,950 2018-06-26

Basercms MEDIUM 5.4

CVE-2018-0570

Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authentica…

Fix: after 4.1.0.1

Fix from $1,600 2018-06-26

Basercms CRITICAL 9.8

CVE-2017-10842

SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspe…

Fix: after 4.0.5

Fix from $2,300 2017-08-29

Basercms HIGH 8.8

CVE-2017-10844

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.

Fix: after 4.0.5

Fix from $1,950 2017-08-29

Basercms HIGH 7.5

CVE-2017-10843

baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" fiel…

Fix: after 4.0.5

Fix from $1,950 2017-08-29

Basercms HIGH 8.8

CVE-2016-4876

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of admini…

Patch available