Cross-Site Scripting in baserCMS

published 2020-08-28 6 y ago modified 2026-09-10 1 mo ago also GHSA-4r3m-j6x5-48m3 , EUVD-2020-0591

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.

Patch / fix

fixed in 2 links 2

packagist baserproject/basercms 4.3.7
baserproject basercms < 4.3.7

Exploit prediction

1.29% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
NVD	3.1	7.3	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
NVD	2.0	2.1	AV:N/AC:H/Au:S/C:N/I:P/A:N
GitHub	3.1	7.3	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	baserproject/basercms	>=4.0.0, <4.3.7	4.3.7

Affected products

baserproject basercms

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /baserproject/basercms/commit/94cbfab74c9fd6d04492597a1a684674c3c0e30f
web, patch, third-party-advisory
github.com /baserproject/basercms/security/advisories/GHSA-4r3m-j6x5-48m3
web, patch, third-party-advisory
basercms.net /security/20200827
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2020-15155
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary