CVE-2021-39136 json
Cross-site scripting vulnerability in file upload
published 2021-08-25 5 y ago modified 2026-09-10 1 mo ago also GHSA-hgjr-632x-qpp3 , EUVD-2021-1745
- cvss
- 8.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.
Patch / fix
- packagist baserproject/basercms 4.5.1
- basercms basercms 4.5.1
Exploit prediction
0.93% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | baserproject/basercms | <4.5.1 |
4.5.1 |
Affected products
- baserproject basercms
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc
web, patch, third-party-advisory
-
basercms.net
/security/JVN_14134801
web, vendor-advisory
-
github.com
/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3
web, third-party-advisory
-
jvn.jp
/en/jp/JVN14134801/index.html
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2021-39136
advisory
-
github.com
/baserproject/basercms
package
Sources
- CVE List CVE-2021-39136
- GitHub Advisory GHSA-hgjr-632x-qpp3
- NVD CVE-2021-39136
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.