CVE-2020-15276

2020-10-3019:15:12

Google

osv.dev

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.6%

JSON

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.

CPENameOperatorVersion
basercmseqbasercms-3.0.11.1
basercmseqbasercms-4.3.6
basercmseqbasercms-4.3.3
basercmseqbasercms-4.3.7
basercmseqbasercms-4.0.1
basercmseqbasercms-4.0.8
basercmseqbasercms-4.0.2
basercmseqbasercms-4.1.1
basercmseqbasercms-4.1.6
basercmseqbasercms-4.3.4

Name	Operator	Version
basercms	eq	basercms-3.0.11.1
basercms	eq	basercms-4.3.6
basercms	eq	basercms-4.3.3
basercms	eq	basercms-4.3.7
basercms	eq	basercms-4.0.1
basercms	eq	basercms-4.0.8
basercms	eq	basercms-4.0.2
basercms	eq	basercms-4.1.1
basercms	eq	basercms-4.1.6
basercms	eq	basercms-4.3.4