CVE-2026-27697
baserCMS: SQL injection vulnerability in blog post
CVE-2026-27697 is a medium vulnerability (CVSS 6.9) in Basercms, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in baserproject/basercms 5.2.3.
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
baserCMS: SQL injection vulnerability in blog post
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Record
CVE-2026-27697- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-17257
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Record
EUVD-2026-17257- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vh89-rjph-2g7p
baserCMS has an SQL injection vulnerability in its blog post functionality
baserCMS has a SQL injection vulnerability in blog posts.
Target
baserCMS 5.2.2 and earlier versions
Vulnerability
Malicious SQL may be executed in blog posts.
Countermeasures
Update to the latest version of baserCMS
Please refer to the following page to reference for more information. https://basercms.net/security/JVN_52157568
Credits
Mirai Matsumoto@Future Secure Wave, Inc.
- Record
GHSA-vh89-rjph-2g7p- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Record
CVE-2026-27697- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
baserCMS: SQL injection vulnerability in blog post
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Record
CVE-2026-27697- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-vh89-rjph-2g7p
baserCMS has an SQL injection vulnerability in its blog post functionality
baserCMS has a SQL injection vulnerability in blog posts.
Target
baserCMS 5.2.2 and earlier versions
Vulnerability
Malicious SQL may be executed in blog posts.
Countermeasures
Update to the latest version of baserCMS
Please refer to the following page to reference for more information. https://basercms.net/security/JVN_52157568
Credits
Mirai Matsumoto@Future Secure Wave, Inc.
- Record
GHSA-vh89-rjph-2g7p- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
baserproject/basercmsPackagist |
through 5.2.2 | 5.2.3 |
baserproject/basercmsPackagist |
before 5.2.3, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 45 moreShow less0.0.60.0.70.0.81.0.02.0.0-rc12.0.0-rc22.0.0-rc32.0.0-rc42.0.0-rc52.0.0-rc63.0.103.0.10.13.0.113.0.11.13.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.193.0.203.0.213.0.223.0.233.0.243.0.253.0.263.0.73.0.7.13.0.83.0.8.13.0.93.0.9.14.0.04.0.0-beta4.0.14.0.104.0.10.14.0.114.0.24.0.2.14.0.34.0.4 |
5.2.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
github.com/baserproject/basercms/security/advisories/GHSA-vh89-rjph-2g7p
basercms.net/security/JVN_20837860
nvd.nist.gov/vuln/detail/CVE-2026-27697
Left out here: 105 versions. The JSON record has them.