CVE-2018-18943

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-11-05 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI.

Affected products

baserproject basercms: before 4.1.4 — fixed in 4.1.4

How to fix

Upgrade to a fixed version: baserproject basercms 4.1.4. Check the vendor advisory for mitigations.

References

http://sunu11.com/2018/10/31/baserCMS/
https://basercms.net/release/4_1_4
http://sunu11.com/2018/10/31/baserCMS/
https://basercms.net/release/4_1_4

Get alerted when CVE-2018-18943 or the next vulnerability affects your stack