Most recent entries from all

cnvd-2023-93330

EUVD-2026-161755

fkie_cve-2023-43792

baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available.

GHSA-vrm6-c878-fpq6 — baserCMS Code Injection Vulnerability in Mail Form Feature

Affected: Packagist: baserproject/basercms

There is a Code Injection Vulnerability in Mail Form to baserCMS.

### Target baserCMS 4.7.6 and earlier versions

### Vulnerability Malicious code may be executed in Mail Form Feature.

### Countermeasures Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_45547161

### Credits Shiga Takuma@BroadBand Security, Inc

gsd-2023-43792

jvndb-2023-000106

baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below.<ul><li>Stored cross-site scripting vulnerability (CWE-79) - CVE-2023-29009</li><li>Reflected cross-site scripting vulnerability (CWE-79) - CVE-2023-43647</li><li>Directory traversal vulnerability (CWE-22) - CVE-2023-43648</li><li>Cross-site request forgery vulnerability (CWE-352) - CVE-2023-43649</li><li>Arbitrary file upload vulnerability (CWE-434) - CVE-2023-43792</li></ul> CVE-2023-29009 Kyohei Ota reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2023-43647, CVE-2023-43648, CVE-2023-43649, CVE-2023-43792 Shiga Takuma of BroadBand Security, Inc reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.