CVE-2020-15159: Basercms

High severity, CVSS 7.6. EPSS: 2.2% chance of exploitation in the next 30 days.

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.

Affected products

• Basercms Basercms: up to and including 4.3.6

Published 2020-08-28. Last modified 2026-06-17.