Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2023-29009: baserCMS favorites feature may run unwanted scripts
CVE-2023-29009 · published 3 years ago
Summary
Versions of baserCMS before 4.8.0 allow a malicious web page to inject code through the Favorites feature. This could let an attacker display or change content for users who visit the site. Upgrade baserCMS to version 4.8.0 or newer to close the problem.
What to do
- Update baserproject basercms to version 4.8.0.
- Update basercms basercms to version 4.8.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | baserproject | basercms |
< 4.8.0 Fix: upgrade to 4.8.0
|
| – | basercms | basercms |
< 4.8.0 cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* |
Original advisory text
basercms XSS Vulnerability via Favorites Feature
baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0.
References
- https://github.com/baserproject/basercms/commit/919c3ccbbd7a2432967dcb2e428131cc...
- https://github.com/advisories/GHSA-8vqx-prq4-rqrq
- https://basercms.net/security/JVN_45547161 URL
- https://github.com/baserproject/basercms/releases/tag/basercms-4.8.0 URL
- https://github.com/baserproject/basercms/security/advisories/GHSA-8vqx-prq4-rqrq Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29009... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-29009 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Oct 2023
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta