{"id":"CVE-2021-39136","aliases":["EUVD-2021-1745","GHSA-hgjr-632x-qpp3"],"status":"published","title":"Cross-site scripting vulnerability in file upload","description":"baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00929,"percentile":0.61006,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-08-25T18:05:13Z","modified":"2026-10-20T10:54:52Z","fixes":[{"ecosystem":"Packagist","package":"baserproject/basercms","fixed_in":["4.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"baserproject/basercms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.5.0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"baserproject/basercms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","1.0.0","2.0.0-rc1","2.0.0-rc2","2.0.0-rc3","2.0.0-rc4","2.0.0-rc5","2.0.0-rc6","3.0.10","3.0.10.1","3.0.11","3.0.11.1","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.20","3.0.21","3.0.22","3.0.23","3.0.24","3.0.25","3.0.26","3.0.7","3.0.7.1","3.0.8","3.0.8.1","3.0.9","3.0.9.1","4.0.0","4.0.0-beta","4.0.1","4.0.10","4.0.10.1","4.0.11","4.0.2","4.0.2.1","4.0.3","4.0.4","4.0.5","4.0.5.1","4.0.5.2","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.1","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.1","4.3.2","4.3.3","4.3.4","4.3.5","4.3.6","4.3.7","4.3.7.1","4.4.0","4.4.1","4.4.1.1","4.4.2","4.4.2.1","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.5.0"]}],"products":[{"vendor":"basercms","product":"basercms"},{"vendor":"baserproject","product":"basercms"}],"references":[{"url":"https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://basercms.net/security/JVN_14134801","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://jvn.jp/en/jp/JVN14134801/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39136","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hgjr-632x-qpp3"},{"url":"https://github.com/baserproject/basercms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-39136","title":"Cross-site scripting vulnerability in file upload","description":"baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.","status":"published","published":"2021-08-25T18:05:13Z","modified":"2024-08-04T01:58:17.928Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:09.540052Z"}],"euvd":[{"id":"EUVD-2021-1745","description":"baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.","status":"published","published":"2021-08-25T18:05:13Z","modified":"2024-08-04T01:58:17Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:24.305495Z"}],"ghsa":[{"id":"GHSA-hgjr-632x-qpp3","title":"Cross-site scripting vulnerability in file upload","description":"There is a cross-site scripting vulnerability in file upload on the management system of baserCMS.\n\nThis is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.\nIf you are eligible, please update to the new version as soon as possible.\n\n### Target\nbaserCMS 4.5.1 and earlier versions\n\n### Vulnerability\nExecution of malicious JavaScript code may alter the display of the page or leak cookie information.\n\n### Countermeasures\nUpdate to the latest version of baserCMS\n\nPlease refer to the next page for details.\nhttps://basercms.net/security/JVN_14134801","status":"published","published":"2021-08-30T16:18:59Z","modified":"2023-02-01T05:06:23Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:38.281533Z"}],"nvd":[{"id":"CVE-2021-39136","description":"baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.","status":"published","published":"2021-08-25T18:15:07.177Z","modified":"2026-06-17T04:03:08.297Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"CVE-2021-39136","description":"baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.","status":"published","published":"2021-08-25T18:15:07.177Z","modified":"2026-10-20T10:54:52.780060581Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"GHSA-hgjr-632x-qpp3","title":"Cross-site scripting vulnerability in file upload","description":"There is a cross-site scripting vulnerability in file upload on the management system of baserCMS.\n\nThis is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.\nIf you are eligible, please update to the new version as soon as possible.\n\n### Target\nbaserCMS 4.5.1 and earlier versions\n\n### Vulnerability\nExecution of malicious JavaScript code may alter the display of the page or leak cookie information.\n\n### Countermeasures\nUpdate to the latest version of baserCMS\n\nPlease refer to the next page for details.\nhttps://basercms.net/security/JVN_14134801","status":"published","published":"2021-08-30T16:18:59Z","modified":"2026-09-10T03:49:08.070520451Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.28217Z"}]}}