Most recent entries from all

EUVD-2026-278291

fkie_cve-2026-30880

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.

GHSA-6hpg-8rx3-cwgv — baserCMS has OS command injection vulnerability in installer

Affected: Packagist: baserproject/basercms

baserCMS has an OS command injection vulnerability in the installer.

### Target baserCMS 5.2.2 and earlier versions

### Vulnerability

If baserCMS is placed on a server but not installed, malicious commands may be executed.

### Countermeasures Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_54513170

### Credits

REN XINGDIAN

jvndb-2026-000047

baserCMS provided by baserCMS User Community contains multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/89.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><ul><li>Cross-site scripting (CWE-79) - CVE-2026-30879</li><li>OS command injection (CWE-78) - CVE-2026-30880</li><li>SQL injection (CWE-89) - CVE-2026-27697</li><li>Cross-site scripting (CWE-79) - CVE-2026-32734</li></ul>CVE-2026-30879 Gai Tanaka of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. quanlna2 (Le Nguyen Anh Quan), namdi (Do Ich Nam), minhnn42 (Nguyen Ngoc Minh) of VCSLab - Viettel Cyber Security reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-30880 REN XINGDIAN reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-27697 Mirai Matsumoto of Future Secure Wave, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-32734 quanlna2 (Le Nguyen Anh Quan), namdi (Do Ich Nam), minhnn42 (Nguyen Ngoc Minh) of VCSLab - Viettel…