Is CVE-2026-93463 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93463 being exploited in the wild.

How severe is CVE-2026-93463?

Medium severity, with a CVSS score of 5.4, published 30 September 2026.

Which products and versions are affected?

baserCMS User Community baserCMS 5.0.0 to 5.4.0.

Is there a fix for CVE-2026-93463?

A patch was published on 2026-09-25: Fixed in version 5.4.1 and 5.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93463 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93463?

Check whether you run baserCMS User Community baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93463: baserCMS script validation bypass cross-site scripting

CVE-2026-93463 · Severity: medium · CVSS 5.4 · Published 2026-09-30

baserCMS is a content management system for building and managing websites. CVE-2026-93463 is a cross-site scripting vulnerability in the script validation function that can be bypassed to execute arbitrary JavaScript in the browsers of site visitors. This could allow an attacker to steal user session data, deface content, or perform actions on behalf of legitimate users.

Technologies: baserCMS User Community baserCMS. Vendors: baserCMS User Community.

Quick answers

Is CVE-2026-93463 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93463 being exploited in the wild.
How severe is CVE-2026-93463?: Medium severity, with a CVSS score of 5.4, published 30 September 2026.
Which products and versions are affected?: baserCMS User Community baserCMS 5.0.0 to 5.4.0.
Is there a fix for CVE-2026-93463?: A patch was published on 2026-09-25: Fixed in version 5.4.1 and 5.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93463 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93463?: Check whether you run baserCMS User Community baserCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The containsScript validation function in baserCMS fails to properly filter malicious script payloads, allowing an attacker to bypass the check and inject arbitrary JavaScript code. The vulnerability requires network access and affects authenticated users or public-facing content depending on the deployment. An attacker can execute arbitrary scripts in the context of a victim's browser session.

Affected products

baserCMS User Community baserCMS 5.0.0 to 5.4.0

Timeline

2026-09-25: disclosed
2026-09-25: patched: Fixed in version 5.4.1 and 5.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.