CVE-2026-93464
Received Received - Intake

Stored XSS in baserCMS via Custom Content Descriptions

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: JPCERT/CC

Description
Stored Cross-Site Scripting via custom content descriptions vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-93464
EUVD
EUVD-2026-89663

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
basercms basercms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in baserCMS. It allows an attacker to inject malicious scripts into custom content descriptions. When other users view this content, the script executes in their browsers, potentially stealing data or performing unauthorized actions.

Detection Guidance

Detection involves checking for stored XSS in custom content descriptions. Manually review user-generated content for suspicious scripts or payloads. Use web application firewalls to log and block potential XSS attempts. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal user sessions, deface websites, or redirect users to malicious sites. Users with access to baserCMS could inadvertently introduce harmful scripts that affect other users viewing the content.

Compliance Impact

This vulnerability may violate GDPR by exposing user data through script execution. For HIPAA, it could compromise protected health information if exploited in healthcare-related content. Organizations must address it to maintain compliance.

Mitigation Strategies

Update baserCMS to the latest patched version. Sanitize user inputs to prevent script injection. Implement content security policies to restrict inline scripts. Regularly audit stored content for malicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart