CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15154 – Cross Site Scripting in baserCMS
https://notcve.org/view.php?id=CVE-2020-15154
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js. The issue is fixed in version 4.3.7. baserCMS versiones 4.3.6 y anteriores, esta afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS) por medio de la ejecución de un script arbitrario. Se requiere acceso de administrador para explotar esta vulnerabilidad. • https://basercms.net/security/20200827 https://github.com/baserproject/basercms/security/advisories/GHSA-cpxc-67rc-c775 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18942
https://notcve.org/view.php?id=CVE-2018-18942
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter. En baserCMS en versiones anteriores a la 4.1.4, lib\Baser\Model\ThemeConfig.php permite que atacantes remotos ejecuten código PHP arbitrario mediante el parámetro data[ThemeConfig][logo] en admin/theme_configs/form. • http://sunu11.com/2018/10/31/baserCMS https://basercms.net/release/4_1_4 https://github.com/baserproject/basercms/issues/959 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18943
https://notcve.org/view.php?id=CVE-2018-18943
An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI. Se ha descubierto un problema en versiones anteriores a la 4.1.4 de baserCMS. En la característica Register New Category del menú Upload, el nombre de categoría se puede emplear para Cross-Site Scripting (XSS) mediante el parámetro data[UploaderCategory][name] en un URI admin/uploader/uploader_categories/edit. • http://sunu11.com/2018/10/31/baserCMS https://basercms.net/release/4_1_4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-4879
https://notcve.org/view.php?id=CVE-2016-4879
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. Vulnerabilidad de tipo cross-site request forgery (CSRF) en el plugin Mail para baserCMS en versiones 3.0.10 y anteriores, que permitiría a atacantes remotos secuestrar la autenticación de los administradores a través de vectores no especificados. • http://basercms.net/security/JVN92765814 http://www.securityfocus.com/bid/93217 https://jvn.jp/en/jp/JVN92765814/index.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5641
https://notcve.org/view.php?id=CVE-2015-5641
SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en baserCMS en versiones anteriores a 3.0.8 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://basercms.net/security/JVN79633796 http://jvn.jp/en/jp/JVN79633796/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000139 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •