baserCMS CVE-2026-93460

Exploitation targets baserCMS installations that expose the mail/email form feature; the attacker must be able to submit crafted strings into the email form fields (the CVSS PR:L indicates some privilege is required) and the payload only executes when a user or administrator subsequently views the stored content in a browser (UI:R). Limiting factors: requires the mail form functionality to be in use, requires the low-privilege access implied by PR:L, and requires victim interaction (viewing the malicious submission); impact is confined to browser-side script execution with low confidentiality/integrity effect and no availability impact.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in baserCMS mail/email form fields, scored 5.4 (medium) under CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The signals are consistent and modest: network attack vector with low complexity, but exploitation requires some level of privilege (PR:L) and, critically, victim interaction (UI:R) - the injected script only fires when a user/administrator later renders the affected content. The scope change (S:C) reflects that the payload executes in the victim's browser session, a different security authority than the injection point, but impact is capped at low confidentiality and low integrity with no availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - so exploitation status is 'no public exploit identified at time of analysis.' No conflicting signals are present; the CVSS vector and the description agree. This is a legitimate but lower-tier issue: real enough to patch on a normal cycle, but not an emergency given the auth requirement, required user interaction, and bounded impact. The primary real-world constraint on risk is the small deployment footprint of baserCMS rather than any doubt about the vulnerability itself.

An attacker submits a baserCMS email/contact form (or influences its fields) with a specially crafted string that includes malicious markup, which baserCMS stores without adequate output encoding. When an administrator or user later views the stored submission in their browser, the script executes in their session, enabling session-context actions such as stealing cookies or performing actions as the victim. No public proof-of-concept is referenced, and the attack depends on a victim viewing the poisoned content (UI:R).