SQL Injection Vulnerability in baserCMS Product by baserProject

CVE-2026-76635

What is CVE-2026-76635?

The baserCMS software prior to version 5.3.0 suffers from a SQL injection vulnerability within the BcDatabaseService.php file. This issue enables authenticated administrators to inject malicious table names and configuration values into SQL statements during various operations such as sequence updates, CSV exports, and table management. Moreover, this vulnerability can be exploited in conjunction with a backup restore code injection flaw, allowing PHP code outside class definitions in schema files to execute unconditionally upon loading. This creates opportunities for attackers to trigger error-based SQL injections, potentially exposing sensitive database information like version details, schema contents, and arbitrary data from the PostgreSQL backend.

References