Basercms CVE-2026-27697

Despite the absence of a CVSS score in the provided data, the SQL injection classification (CWE-89) combined with blog post input vectors indicates high real-world risk. SQL injection typically enables unauthorized database access, credential theft, privilege escalation, and potential remote code execution depending on database permissions and backend configuration. The lack of CVSS or EPSS data prevents quantification of exploitation probability, but SQL injection in public-facing content management systems is generally considered immediately exploitable with minimal attack complexity. No KEV (CISA Known Exploited Vulnerability) designation or public exploit code has been identified, suggesting the vulnerability may be relatively recent or not yet widely discovered; however, the straightforward nature of SQL injection and public disclosure through GitHub security advisories increases the likelihood of rapid exploit development. Organizations running baserCMS before version 5.2.3 should prioritize patching given the direct unauthenticated attack vector.

An unauthenticated attacker submits a crafted blog post containing SQL metacharacters (e.g., single quotes, UNION clauses) through the blog creation or comment interface. If input validation is absent or bypassable, the injected SQL executes within the database context, allowing the attacker to extract user credentials, modify published content, or escalate privileges. No public exploit code has been identified, but the straightforward nature of SQL injection in content management systems means proof-of-concept development is likely rapid post-disclosure.