baserCMS CVE-2026-93463

Exploitation requires an authenticated baserCMS account (PR:L) able to submit content that passes through the affected input path, plus the ability to craft a payload that bypasses baserCMS's script validation filter. Execution is limited by required victim user interaction (UI:R) - a second user must load the page hosting the injected script - and by the prior-authentication requirement, so this is not remotely exploitable against an unauthenticated attacker. Realistic risk is further limited by the small deployment base of baserCMS and the absence of any public exploit code.

This is a stored/validation-bypass XSS in baserCMS scored CVSS 3.0 5.4 (medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The signals are internally consistent and modest: network vector with low complexity, but exploitation requires an authenticated actor (PR:L) and victim interaction (UI:R), and the impact is limited to low confidentiality and low integrity with no availability effect. The scope change (S:C) reflects script executing in the victim's browser context distinct from the vulnerable component, which is standard for reflected/stored XSS. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a real but lower-tier priority: the requirement for prior authentication plus user interaction and the niche footprint of baserCMS constrain real-world impact relative to the raw score. Treat it as routine patch-cycle remediation rather than an emergency.

An authenticated baserCMS user with content-entry privileges submits input containing a script payload crafted to bypass the CMS's script validation filter. When another user - such as an administrator or site visitor - views the affected page, the payload executes in their browser, enabling session-context actions like cookie theft or limited data manipulation. No public proof-of-concept is available, and exploitation requires both valid credentials and victim interaction.