Most recent entries from all

EUVD-2026-197403

fkie_cve-2024-46995

baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes this issue.

GHSA-mr7q-fv7j-jcgv — baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request

Affected: Packagist: baserproject/basercms

XSS vulnerability in HTTP 400 Bad Request to baserCMS.

### Target baserCMS 5.1.1 and earlier versions

### Vulnerability Malicious code may be executed in HTTP 400 Bad Request.

### Countermeasures Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_00876083

jvndb-2024-000114

baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below.<ul><li>Stored cross-site scripting vulnerability due to inappropriate Slug handling on Article Edit (CWE-79) - CVE-2024-46996</li><li>Stored cross-site scripting vulnerability on Edit Email Form Settings (CWE-79) - CVE-2024-46998</li><li>Reflected cross-site scripting vulnerability due to inadequate error page generation process (CWE-81) - CVE-2024-46995</li><li>Stored cross-site scripting vulnerability due to inappropriate input data handling on Article Edit and Content List (CWE-79) - CVE-2024-46994</li></ul>CVE-2024-46996 Ayato Shitomi of Fore-Z co.ltd and Rikuto Tauchi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2024-46998 Ayato Shitomi of Fore-Z co.ltd reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2024-46995 Yusuke Uchida of PERSOL CROSS TECHNOLOGY CO., LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2024-46994 Kyohei Ota of LEON TECHNOLOGY,Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.