What’s Vulnerable › Products

baserproject basercms vulnerabilities

78 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your baserproject basercms version is affected

Latest baserproject basercms vulnerabilities

• CVE-2026-115481 — baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload (CVSS 8.5)
• CVE-2026-115480 — baserCMS: Public Web API mail-form submission bypasses image CAPTCHA (CVSS 5.3)
• CVE-2026-115479 — baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients (CVSS 5.3)
• CVE-2026-115457 — baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments (CVSS 7.1)
• CVE-2026-114624 — baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity (CVSS 7.2)
• CVE-2026-114623 — baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure (CVSS 6.5)
• CVE-2026-114622 — baserCMS: Encoded path traversal bypass in the theme file API (CVSS 7.2)
• CVE-2026-114621 — baserCMS: SQL injection in the admin panel and admin API (CVSS 8.8)
• CVE-2026-76635 — baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php (CVSS 7.2)
• CVE-2026-65875 — (CVSS 7.1)
• CVE-2026-32734 — baserCMS: Multiple vulnerabilities in baserCMS (CVSS 6.1)
• CVE-2026-30940 — baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE (CVSS 7.2)
• CVE-2026-30880 — baserCMS: OS command injection vulnerability in installer (CVSS 9.8)
• CVE-2026-30879 — baserCMS: Cross-site scripting vulnerability in blog post (CVSS 6.1)
• CVE-2026-30878 — baserCMS: Mail Form Acceptance Bypass via Public API (CVSS 5.3)
• CVE-2026-30877 — baserCMS: OS Command Injection in the baserCMS Update Functionality (CVSS 7.2)
• CVE-2026-27697 — baserCMS: SQL injection vulnerability in blog post (CVSS 9.8)
• CVE-2026-21861 — baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) (CVSS 7.2)
• CVE-2025-32957 — baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) (CVSS 7.2)
• CVE-2024-46998 — baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature (CVSS 5.4)
• CVE-2024-46996 — baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature (CVSS 5.4)
• CVE-2024-46995 — baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request (CVSS 6.1)
• CVE-2024-46994 — baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature (CVSS 5.4)
• CVE-2024-26128 — baserCMS Cross-site Scripting vulnerability in Content Management (CVSS 5.4)
• CVE-2023-51450 — baserCMS OS command injection vulnerability in Installer (CVSS 8.1)