CVE-2020-15159
Cross Site Scripting leading to RCE in baserCMS
CVE-2020-15159 is a high vulnerability (CVSS 7.6) in Basercms, published August 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in baserproject/basercms 4.3.7.
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cross Site Scripting leading to RCE in baserCMS
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
- Record
CVE-2020-15159- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2020-0597
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
- Record
EUVD-2020-0597- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-673x-f5wx-fxpw
Cross Site Scripting and RCE in baserCMS
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).
- Impact: XSS to RCE via Arbitrary file upload.
- Attack vector is: Administrator must be logged in.
- Components are: ThemeFilesController.php, UploaderFilesController.php.
- Tested baserCMS Version : 4.3.6 (Latest)
- Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
- Patches : https://basercms.net/security/20200827
Found by Vulnerability Research team in Flatt Security Inc.
- Record
GHSA-673x-f5wx-fxpw- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
- Record
CVE-2020-15159- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:N/AC:H/Au:S/C:P/I:P/A:P - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
- Record
CVE-2020-15159- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-673x-f5wx-fxpw
Cross Site Scripting and RCE in baserCMS
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).
- Impact: XSS to RCE via Arbitrary file upload.
- Attack vector is: Administrator must be logged in.
- Components are: ThemeFilesController.php, UploaderFilesController.php.
- Tested baserCMS Version : 4.3.6 (Latest)
- Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
- Patches : https://basercms.net/security/20200827
Found by Vulnerability Research team in Flatt Security Inc.
- Record
GHSA-673x-f5wx-fxpw- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
baserproject/basercmsPackagist |
4.0.0 to 4.3.6 | 4.3.7 |
baserproject/basercmsPackagist |
4.0.0 up to 4.3.7, plus listed versions 4.0.14.0.104.0.10.14.0.114.0.2 Show 33 moreShow less4.0.2.14.0.34.0.44.0.54.0.5.14.0.5.24.0.64.0.74.0.84.0.94.1.04.1.0.14.1.14.1.24.1.34.1.44.1.54.1.64.1.74.1.84.2.04.2.14.2.24.2.34.2.44.2.54.3.04.3.14.3.24.3.34.3.44.3.54.3.6 |
4.3.7 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |