Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0

ALTO 8.7CVE-2020-15276 · GHSA-fw5q-j9p4-3vxg · Published 30/10/2020 · updated 17/06/2026

In breve

CVE-2020-15276 è una vulnerabilità ALTO (CVSS 8.7) che riguarda baserproject/basercms, basercms (basercms).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 62.9% delle vulnerabilità.
Correzione: aggiornare a 4.4.1 o successiva.

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`≥ 4.4.0, < 4.4.1`	`4.4.1`
basercms basercms	`≥ 4.0.0, < 4.4.1`	`4.4.1`

Description

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

Impact: XSS via Arbitrary script execution. Components are: Blog comment posting Tested baserCMS Version : 4.4.0 (Latest) Affected baserCMS Version : 4.0.0 ~ 4.4.0 Patches : https://basercms.net/security/20201029 Found by yama

NVD description

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.

References

baserproject/basercms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-15276 · ADVISORY
baserproject/basercms commit d14f506 · WEB
basercms.net/security/20201029 · WEB

Altre vulnerabilità di baserproject/basercms

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

baserproject/basercms

Packagist

≥ 4.4.0, < 4.4.1

4.4.1

basercms

≥ 4.0.0, < 4.4.1

4.4.1

Description

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

NVD description

Altre vulnerabilità di baserproject/basercms

Vedi tutto →