SQL Injection Vulnerability in baserCMS Admin Panel
CVE-2026-114621
What is CVE-2026-114621?
baserCMS, a website development framework, is susceptible to SQL injection attacks in versions 5.0.0 through 5.3.2 and 5.4.0 through 5.4.2. The vulnerability allows authenticated users with access to the admin panel to inject SQL fragments into request query parameters, enabling unauthorized SQL execution against the database. Notably, this flaw allows attackers to read sensitive information, like password hashes from the users table. Despite earlier patches for public-facing API endpoints, these administrative paths remained open to exploitation. Versions 5.3.2 and 5.4.2 address this critical oversight. For robust security, it’s essential to upgrade to these patched versions.
Affected Version(s)
basercms >= 5.0.0, < 5.3.2 < 5.0.0, 5.3.2
basercms >= 5.4.0, < 5.4.2 < 5.4.0, 5.4.2