baserproject baserCMS arbitrary file upload vulnerability

BaserProject baserCMS versions prior to 5.0.0-beta1 and 5.3.2, as well as versions 5.4.0 and 5.4.2, contain an arbitrary file upload vulnerability. This vulnerability arises because PermissionGroupsService::build writes wildcard allow rules when the plugin lacks config/permission.php, allowing th...

baserproject baserCMS input validation error vulnerability

In versions prior to 5.3.2 of baserproject baserCMS, there is an input validation error vulnerability. This vulnerability arises because unauthenticated visitors can provide comma-separated address lists in the email field of public mail forms; the system fails to adequately validate this input. ...

baserproject baserCMS SQL injection vulnerability

BaserProject baserCMS versions prior to 5.0.0 and 5.3.2, as well as versions prior to 5.4.0 and 5.4.2, contain an SQL injection vulnerability. This vulnerability arises because list and detail operations in Admin and Api/Admin prefixes include request query parameters such as contain, conditions,...

Cross-site Scripting (XSS)

baserproject/basercms is vulnerable to cross-site scripting. The vulnerability exists due to insufficient sanitization of user-supplied data in user group management feature which allows an attacker to inject and execute malicious javaScript on victim's browser...

Cross-site Scripting (XSS)

baserproject/basercms is vulnerable to cross-site scripting. The vulnerability exists when the management system is used by an unspecified number of users which allows an attacker to inject and execute malicious JavaScript...

Cross-site Scripting (XSS)

baserproject/basercms is vulnerable to cross-site scripting. The file upload function on the management system does not escape user-provided data, allowing an attacker to inject and execute malicious javascript...