Lucene search
+L

6 matches found

NVD
NVD
•added 2026/10/23 2:17 p.m.•15 views

CVE-2026-114624

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

7.2CVSS0.00885EPSS
SaveExploits0References5
osv_cve
osv_cve
•added 2026/10/23 1:47 p.m.•23 views

CVE-2026-114624 baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

7.2CVSS5.9AI score
SaveExploits0References7
EUVD
EUVD
•added 2026/10/23 1:47 p.m.•17 views

EUVD-2026-108995

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

7.2CVSS6AI score0.00885EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/10/23 12:00 a.m.•26 views

PT-2026-122103

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

7.2CVSS6AI score0.00885EPSS
SaveExploits0References6
Mend
Mend
•added 2026/07/08 7:33 p.m.•6 views

CVE-2026-59947

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

5.7CVSS5.9AI score0.0012EPSS
SaveExploits0References8
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/08 12:00 a.m.•7 views

CVE-2026-59947: Insertion of Sensitive Information into Log File

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

4.7CVSS5.9AI score0.0012EPSS
SaveExploits0References2
Rows per page
Query Builder