Repository navigation
Security: baserproject/basercms
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
bc-mcp OAuth2 signing private key written with default (world-readable) mode; league CryptKey permission check disabledGHSA-8qvr-v52m-fj2h published
Sep 26, 2026 by ryuringModerate -
【JVN#76990966】Cross-site scripting via script-validation bypass in containsScriptGHSA-xqr4-p67x-mw3m published
Sep 26, 2026 by ryuringModerate -
【JVN#26271410】Stored XSS via custom content descriptionGHSA-m854-6p5c-8g3j published
Sep 26, 2026 by ryuringModerate -
【JVN#14353754】Stored XSS via unescaped mail form field stringsGHSA-h337-q2mw-vw6m published
Sep 26, 2026 by ryuringModerate -
【JVN#56752971】Unauthenticated disclosure of unapproved blog comments (including submitter email) via the public blog comments APIGHSA-q44m-9xgf-xwmm published
Sep 26, 2026 by ryuringModerate -
baserCMS view_limited_file arbitrary file read via path traversal (admin session -> DB credentials)GHSA-p22r-jcj7-mf93 published
Sep 26, 2026 by ryuringModerate -
Admin Two-Factor Authentication (2FA) Code Can Be Brute-Forced Due to Missing Rate LimitingGHSA-pqvq-3jg5-27x4 published
Sep 26, 2026 by ryuringHigh -
Unauthenticated SQL Injection + Code Execution via Nested `contain` in Public Custom Content Front ActionsGHSA-2ghw-gwvv-mv56 published
Sep 26, 2026 by ryuringCritical -
Unauthenticated SQL Injection + Code Execution via Nested `contain` in Public Blog Front RoutesGHSA-ch8f-q957-r9xm published
Sep 26, 2026 by ryuringCritical -
Unauthenticated SQL Injection + Code Execution via Nested contain in the Public BlogTags APIGHSA-v9g2-xmwr-23vc published
Sep 26, 2026 by ryuringCritical