CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

PT-2026-122101

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm:: execute subsequently applies rawurldecode to fullpath before...

PT-2026-122102

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs...

PT-2026-122121

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode...

PT-2026-122104

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties...

PT-2026-122105

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail messages/add/mailContentId.json endpoint accepts submissions without enforcing the form's auth captcha setting. BcMailControllerApiMailMessagesController::ad...

PT-2026-122103

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

PT-2026-122100

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

PT-2026-122106

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93460

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93462

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

CVE-2026-93463

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93462

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

EUVD-2026-89673

Missing authentication for critical function vulnerability exists in baserCMS . If a remote unauthenticated attacker there is a possibility that sensitive information could be obtained...

CVE-2026-93462

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

CVE-2026-93462

A missing authentication for critical function vulnerability (CWE-306) exists in baserCMS . A remote unauthenticated attacker can exploit this flaw to obtain sensitive information . To remediate this issue, users should update the software to the latest version provided by the developer.

CVE-2026-93464

A Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in baserCMS due to the handling of custom content descriptions . Exploitation of this flaw allows an attacker to execute arbitrary scripts within a user's web browser. To remediate this issue, users are advised to update the softwa...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...