Is there a patch available for CVE-2026-27697?

Yes, a patch is available for CVE-2026-27697. Update the affected software to the latest version immediately.

Basercms CVE-2026-27697

Q: What is the CVSS score of CVE-2026-27697?

CVE-2026-27697 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17257 MEDIUM

SQL Injection (CWE-89)

2026-03-31 GitHub_M

GHSA-vh89-rjph-2g7p

SQLi Basercms

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 01:00 euvd

EUVD-2026-17257

Analysis Generated

Mar 31, 2026 - 01:00 vuln.today

CVE Published

Mar 31, 2026 - 00:44 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.

AnalysisAI

SQL injection in baserCMS prior to version 5.2.3 allows unauthenticated remote attackers to execute arbitrary SQL queries through unvalidated input in blog post functionality. The vulnerability affects all versions before 5.2.3 and has been patched; no public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

baserCMS is a PHP-based website development framework that manages blog content through database-backed post storage. The SQL injection vulnerability (CWE-89) stems from insufficient input sanitization or parameterization in blog post processing logic, allowing attackers to inject malicious SQL commands that execute within the database context. The framework's blog module fails to properly escape or bind user-supplied parameters before constructing SQL queries, a common pattern in legacy or rapidly-developed content management systems. The vulnerability affects the entire codebase prior to remediation in version 5.2.3 as indicated by the CPE string covering all versions of baserproject:basercms.

RemediationAI

Upgrade baserCMS to version 5.2.3 or later immediately; the patched release is available at https://github.com/baserproject/basercms/releases/tag/5.2.3. If immediate upgrade is not feasible, restrict network access to the blog post creation and editing endpoints using web application firewall (WAF) rules or authentication-layer controls until patching can be performed. Input validation bypass is characteristic of SQL injection, so network-level mitigations should be combined with a rapid patching timeline. Review database user permissions to ensure the baserCMS application account operates with minimal necessary privileges, limiting the impact scope if injection occurs before patching.