55766 matches found
CVE-2026-29924
Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...
Command Injection
Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Command Injection in the core update process. An attacker can execute arbitrary operating system commands on the server by supplying crafted input that is passed...
SQL Injection
Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to SQL Injection via the blog post process. An attacker can execute arbitrary SQL commands by supplying crafted input to the affected component. Remediation Upgrade...
Cross-site Scripting (XSS)
Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the tag creation process. An attacker can execute arbitrary scripts in the context of the user's browser by crafting malicious input...
CVE-2026-30940
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API /baser/api/admin/bc-theme-file/themefiles/add.json that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path...
CVE-2026-30878 baserCMS: Mail Form Acceptance Bypass via Public API
baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables...
CVE-2026-27697
CVE-2026-27697 affects baserCMS before version 5.2.3, where a SQL injection vulnerability exists in the blog posts functionality. The issue, traced to the blog post handling, can allow an attacker to execute arbitrary SQL statements. BasercMS has patched this in 5.2.3; users on earlier versions s...
CVE-2025-32957
baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using requireonce without validating or restricting the filename. An attacke...
BaserCMS operating system command injection vulnerability
BaserCMS is a corporate-level content management system CMS developed by the BaserCMS team. Versions of BaserCMS prior to 5.2.3 had a vulnerability related to operating system command injection. This vulnerability originated from the core module of the installation process. Attackers could...
PT-2026-29145
baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require once without validating or restricting the filename. An attack...
BaserCMS SQL injection vulnerability
BaserCMS is a corporate-level content management system CMS developed by the BaserCMS team. Versions of BaserCMS prior to 5.2.3 had an SQL injection vulnerability; this vulnerability originated from the blog article-related functionality and made it susceptible to SQL injection attacks...
CVE-2026-5203: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the...
PT-2026-29153
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3...
CMS Made Simple (CMSMS) Path traversal vulnerability
CMS Made Simple CMSMS is an open-source content management system developed by the Cmsms team. This system supports role-based permission management, wizard-based installation and update mechanisms, and intelligent caching features. Version 2.2.22 and earlier of CMS Made Simple contained a path...
📄 Grav CMS 1.7.49.5 Remote Code Execution
Grav CMS versions 1.7.49.5 and below with Admin Plugin versions 1.10.49.3 and below are vulnerable to an authenticated remote code execution vulnerability via the "Direct Install" feature in the administrative interface. An authenticated administrator can upload a crafted plugin archive containin...
PT-2026-29288
Name of the Vulnerable Software and Affected Versions CMS Made Simple versions prior to 2.2.23 Description A path traversal issue exists in the UserGuide Module XML Import component. The flaw is located within the copyFilesToFolder function in the...
Biztrx24 Business Management Service Unauthorized Access
Vulnerability of access control for Bitrix24 business management services and 1C-Bitrix website content management systems: Website management is associated with the absence of authentication. Exploiting this vulnerability can allow unauthorized users to gain unauthorized access to server-related...
baserCMS security vulnerabilities
BaserCMS is a corporate-level content management system CMS developed by the BaserCMS team. Versions of BaserCMS prior to 5.2.3 contained security vulnerabilities. These vulnerabilities were caused by path traversal in the theme file management API, which could lead to arbitrary file writing and...
CVE-2026-30878
creationtimestamp| type| source ---|---|--- 2026-03-30 23:03:52+00:00| published-proof-of-concept| https://github.com/baserproject/basercms/security/advisories/GHSA-8cr7-r8qw-gp3c 2026-10-23 15:15:36+00:00| seen| https://infosec.exchange/users/cve/statuses/117490878771224427...
