baserproject basercms vulnerabilities

CVEs per yearBy the year they were published

1. 20206
2. 20213
3. 20221
4. 20237
5. 20247
6. 202618

Newest CVEs

• CVE-2026-115457

  baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments

  baserproject · basercms

  High7.1
• CVE-2026-114624

  baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity

  baserproject · basercms

  High7.2
• CVE-2026-114623

  baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure

  baserproject · basercms

  Medium6.5
• CVE-2026-114622

  baserCMS: Encoded path traversal bypass in the theme file API

  baserproject · basercms

  High7.2
• CVE-2026-114621

  baserCMS: SQL injection in the admin panel and admin API

  baserproject · basercms

  High8.8
• CVE-2026-115480

  baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

  baserproject · basercms

  Medium5.3
• CVE-2026-115479

  baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients

  baserproject · basercms

  Medium5.3
• CVE-2026-115481

  baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

  baserproject · basercms

  High8.5
• CVE-2026-76635

  baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

  baserproject · basercms

  High8.6
• CVE-2026-32734

  baserCMS: Multiple vulnerabilities in baserCMS

  baserproject · basercms

  High7.1