PT-2026-29148 · Basercms · Basercms

Ericueda · Publicado 2026-03-31 · Atualizado 2026-04-02 · CVE-2026-30877

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 5.2.3

Description baserCMS is a website development framework. A security issue exists in the update functionality that allows an authenticated user with administrator privileges to execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. The issue is due to an OS command injection.

Recommendations Update to version 5.2.3 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-30877

GHSA-M9G7-RGFC-JCM7

Produtos afetados

Basercms

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30877.json · Exploit
• https://github.com/baserproject/basercms/security/advisories/GHSA-m9g7-rgfc-jcm7 · Aviso do Fabricante
• https://github.com/baserproject/basercms/releases/tag/5.2.3 · Nota
• https://github.com/baserproject/basercms · Nota
• https://twitter.com/0dayPublishing/status/2039721965796077812 · Publicação no Twitter
• https://basercms.net/security/JVN_20837860 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2038794205590405393 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30877 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2039719332520010189 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038787598437740976 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2038898106792878291 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30877 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-m9g7-rgfc-jcm7 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038916056610455764 · Publicação no Twitter