Most recent entries from all

EUVD-2026-233392

fkie_cve-2022-39325

BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. Users of baserCMS are advised to upgrade as soon as possible. There are no known workarounds for this vulnerability.

GHSA-395x-wv32-44v5 — baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability

Affected: Packagist: baserproject/basercms

There is a cross-site scripting vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

### Target baserCMS 4.7.1 and earlier versions.

### Vulnerability Execution of malicious JavaScript code may alter the display of the page or leak cookie information. - In Favorite registration (CVE-2022-39325) - In Permission Settings (CVE-2022-41994) - In User group management (CVE-2022-42486)

### Countermeasures Update to the latest version of baserCMS

### Credits - Shogo Iyota@Mitsui Bussan Secure Directions, Inc. - YUYA KOTAKE@CARTA HOLDINGS, INC.

gsd-2022-39325

jvndb-2022-000094

baserCMS provided by baserCMS Users Community contains multiple cross-site scripting vulnerabilities listed below. * Stored cross-site scripting vulnerability in User management (CWE-79) - CVE-2022-39325 * Stored cross-site scripting vulnerability in Permission Settings (CWE-79) - CVE-2022-41994 * Stored cross-site scripting vulnerability in User group management (CWE-79) - CVE-2022-42486 CVE-2022-39325 YUYA KOTAKE of CARTA HOLDINGS, INC. and Shogo Iyota of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2022-41994, CVE-2022-42486 Shogo Iyota of Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.