# baserproject/basercms (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/baserproject-basercms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/baserproject-basercms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 56 vulnerabilities in baserproject/basercms (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-32734, was published on 31 March 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 56 (0 critical, 0 exploited in the wild) ## About baserproject/basercms (Packagist) baserCMS is an open-source PHP content management system with administrative functionality. ## Latest baserproject/basercms (Packagist) vulnerabilities - [CVE-2026-32734: baserCMS is Vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2026-32734-basercms-is-vulnerable-to-cross-site-scripting) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2026-30940: baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API](https://junglewise.ai/threats/cve-2026-30940-basercms-path-traversal-leads-to-arbitrary-file-write-and-rce-via) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2026-30880: baserCMS has OS command injection vulnerability in installer](https://junglewise.ai/threats/cve-2026-30880-basercms-has-os-command-injection-vulnerability-in-installer) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2026-30879: baserCMS has a cross-site scripting vulnerability in blog posts](https://junglewise.ai/threats/cve-2026-30879-basercms-has-a-cross-site-scripting-vulnerability-in-blog-posts) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2026-30878: baserCMS has Mail Form Acceptance Bypass via Public API](https://junglewise.ai/threats/cve-2026-30878-basercms-has-mail-form-acceptance-bypass-via-public-api) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2026-30877: baserCMS Update Functionality Vulnerable to OS Command Injection](https://junglewise.ai/threats/cve-2026-30877-basercms-update-functionality-vulnerable-to-os-command-injection) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2026-27697: baserCMS has an SQL injection vulnerability in its blog post functionality](https://junglewise.ai/threats/cve-2026-27697-basercms-has-an-sql-injection-vulnerability-in-its-blog-post) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2026-21861: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)](https://junglewise.ai/threats/cve-2026-21861-basercms-has-os-command-injection-leading-to-remote-code) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2025-32957: baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)](https://junglewise.ai/threats/cve-2025-32957-basercms-has-unsafe-file-upload-leading-to-remote-code-execution) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2024-46998: baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature](https://junglewise.ai/threats/cve-2024-46998-basercms-has-a-cross-site-scripting-xss-vulnerability-in-edit) (low, CVSS 3.1, published 24 Oct 2024) - [CVE-2024-46996: baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature](https://junglewise.ai/threats/cve-2024-46996-basercms-has-a-cross-site-scripting-xss-vulnerability-in-blog) (low, CVSS 3.1, published 24 Oct 2024) - [CVE-2024-46995: baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request](https://junglewise.ai/threats/cve-2024-46995-basercms-has-a-cross-site-scripting-xss-vulnerability-in-http-400) (low, CVSS 3, published 24 Oct 2024) - [CVE-2024-46994: baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature](https://junglewise.ai/threats/cve-2024-46994-basercms-has-a-cross-site-scripting-xss-vulnerability-in-blog) (low, CVSS 3, published 24 Oct 2024) - [CVE-2023-44379: baserCMS Cross-site Scripting vulnerability in Site search Feature](https://junglewise.ai/threats/cve-2023-44379-basercms-cross-site-scripting-vulnerability-in-site-search) (low, CVSS 3.1, published 22 Feb 2024) - [CVE-2023-51450: baserCMS OS command injection vulnerability in Installer](https://junglewise.ai/threats/cve-2023-51450-basercms-os-command-injection-vulnerability-in-installer) (low, CVSS 3.1, published 22 Feb 2024) - [CVE-2024-26128: baserCMS Cross-site Scripting vulnerability in Content Management](https://junglewise.ai/threats/cve-2024-26128-basercms-cross-site-scripting-vulnerability-in-content-management) (low, CVSS 3.1, published 22 Feb 2024) - [CVE-2023-43792: baserCMS Code Injection Vulnerability in Mail Form Feature](https://junglewise.ai/threats/cve-2023-43792-basercms-code-injection-vulnerability-in-mail-form-feature) (low, CVSS 3, published 26 Oct 2023) - [CVE-2023-43649: baserCMS CSRF vulnerability in Content preview Feature](https://junglewise.ai/threats/cve-2023-43649-basercms-csrf-vulnerability-in-content-preview-feature) (low, CVSS 3, published 26 Oct 2023) - [CVE-2023-43648: baserCMS Directory Traversal vulnerability in Form submission data management Feature](https://junglewise.ai/threats/cve-2023-43648-basercms-directory-traversal-vulnerability-in-form-submission) (low, CVSS 3, published 26 Oct 2023) - [CVE-2023-43647: baserCMS Cross-site Scripting vulnerability in File upload Feature](https://junglewise.ai/threats/cve-2023-43647-basercms-cross-site-scripting-vulnerability-in-file-upload) (low, CVSS 3, published 26 Oct 2023) - [CVE-2023-29009: baserCMS Cross-site Scripting Vulnerability in Favorites Feature](https://junglewise.ai/threats/cve-2023-29009-basercms-cross-site-scripting-vulnerability-in-favorites-feature) (low, CVSS 3.1, published 26 Oct 2023) - [CVE-2023-25655: baserCMS allows any file to be uploaded](https://junglewise.ai/threats/cve-2023-25655-basercms-allows-any-file-to-be-uploaded) (low, CVSS 3.1, published 23 Mar 2023) - [CVE-2023-25654: baserCMS File Uploader Remote Code Execution (RCE) vulnerability](https://junglewise.ai/threats/cve-2023-25654-basercms-file-uploader-remote-code-execution-rce-vulnerability) (low, CVSS 3.1, published 23 Mar 2023) - [CVE-2022-42486: baserCMS vulnerable to stored Cross-site Scripting](https://junglewise.ai/threats/cve-2022-42486-basercms-vulnerable-to-stored-cross-site-scripting) (low, CVSS 3.1, published 7 Dec 2022) - [CVE-2022-41994: baserCMS vulnerable to stored Cross-site Scripting](https://junglewise.ai/threats/cve-2022-41994-basercms-vulnerable-to-stored-cross-site-scripting) (low, CVSS 3.1, published 7 Dec 2022) ## Most severe baserproject/basercms (Packagist) vulnerabilities - [CVE-2026-30880: baserCMS has OS command injection vulnerability in installer](https://junglewise.ai/threats/cve-2026-30880-basercms-has-os-command-injection-vulnerability-in-installer) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2026-27697: baserCMS has an SQL injection vulnerability in its blog post functionality](https://junglewise.ai/threats/cve-2026-27697-basercms-has-an-sql-injection-vulnerability-in-its-blog-post) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2026-30879: baserCMS has a cross-site scripting vulnerability in blog posts](https://junglewise.ai/threats/cve-2026-30879-basercms-has-a-cross-site-scripting-vulnerability-in-blog-posts) (medium, CVSS 4, published 31 Mar 2026) - [CVE-2021-20682: OS Command Injection in baserCMS](https://junglewise.ai/threats/cve-2021-20682-os-command-injection-in-basercms) (low, CVSS 3.1, published 8 Jun 2021) - [CVE-2020-15277: Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0](https://junglewise.ai/threats/cve-2020-15277-edit-template-remote-code-execution-rce-vulnerability-in-latest) (low, CVSS 3.1, published 30 Oct 2020) - [CVE-2026-21861: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)](https://junglewise.ai/threats/cve-2026-21861-basercms-has-os-command-injection-leading-to-remote-code) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2021-41243: OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS](https://junglewise.ai/threats/cve-2021-41243-os-command-injection-vulnerability-and-potential-zip-slip) (low, CVSS 3.1, published 1 Dec 2021) - [CVE-2020-15159: Cross Site Scripting and RCE in baserCMS](https://junglewise.ai/threats/cve-2020-15159-cross-site-scripting-and-rce-in-basercms) (low, CVSS 3.1, published 28 Aug 2020) - [CVE-2026-30877: baserCMS Update Functionality Vulnerable to OS Command Injection](https://junglewise.ai/threats/cve-2026-30877-basercms-update-functionality-vulnerable-to-os-command-injection) (low, CVSS 3.1, published 31 Mar 2026) - [CVE-2021-41279: Potential Zip Slip Vulnerability in baserCMS](https://junglewise.ai/threats/cve-2021-41279-potential-zip-slip-vulnerability-in-basercms) (low, CVSS 3.1, published 1 Dec 2021) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "baserproject/basercms (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/baserproject-basercms, 9 November 2026.