{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abasercmsbasercms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-114621"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["baserCMS (5.0.0 through 5.3.1, 5.4.0 through 5.4.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","sqli","authentication"],"_cs_type":"advisory","_cs_vendors":["baserCMS"],"content_html":"\u003cp\u003ebaserCMS versions 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1 are susceptible to SQL injection via the Admin and Api/Admin prefixes. The vulnerability stems from the framework passing request query parameters (specifically contain, conditions, fields, finder, and order) directly to the ORM without sufficient validation. An authenticated attacker can embed SQL fragments within these parameters to manipulate database queries, potentially leading to unauthorized data extraction, such as password hashes. Disabling the core admin API does not mitigate this risk for users with active admin sessions. This issue is resolved in versions 5.3.2 and 5.4.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker with access to the administrative panel to perform arbitrary SQL operations against the underlying application database.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade baserCMS instances to versions 5.3.2 or 5.4.2 immediately to remediate the ORM parameter validation flaw.\u003c/li\u003e\n\u003cli\u003eAudit administrative session logs for unusual patterns or high-volume query parameter usage consistent with SQL injection payloads.\u003c/li\u003e\n\u003cli\u003eRestrict access to administrative and API prefixes at the network or web application firewall level to trusted internal sources only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T15:07:45Z","date_published":"2026-10-23T15:07:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-basercms-sqli/","summary":"baserCMS versions 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1 contain an SQL injection vulnerability in the Admin and Api/Admin interfaces allowing authenticated users to execute arbitrary SQL queries.","title":"baserCMS: SQL injection in administrative prefixes (CVE-2026-114621)","url":"https://feed.craftedsignal.io/briefs/2026-10-basercms-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}