CVE-2026-93460 in BaserCMS
Summary
by MITRE • 09/30/2026
Stored Cross-site scripting via appended strings in email form fields vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified security flaw represents a classic instance of Stored Cross-Site Scripting within the baserCMS platform, specifically targeting email form fields through appended strings. This type of vulnerability arises when an application accepts untrusted input data and stores it for later use without performing adequate validation or sanitization checks before persisting the information to its backend storage system. In this specific context, attackers can inject malicious JavaScript payloads into email address fields during user registration, profile updates, or other interactions where contact details are submitted. Because the vulnerability is classified as stored rather than reflected, the malicious code does not require immediate exploitation via a crafted link; instead, it remains dormant in the database until an administrator or another authorized user views the compromised data through the CMS interface.
From a technical perspective, the core deficiency lies in the insufficient encoding of special characters such as angle brackets, quotes, and ampersands when rendering stored email addresses back to HTML contexts. When the web application retrieves these tainted records from the database and displays them on a webpage without proper context-aware escaping, the browser interprets the injected script tags or event handlers as executable code rather than plain text data. This failure in output encoding allows an attacker to bypass standard content security policies if they are not strictly configured, leading to the execution of arbitrary scripts within the victim's web browser session. The persistence of this payload ensures that every subsequent view of the affected record triggers the malicious behavior, creating a widespread impact vector across all users who access the compromised records.
The operational impact of exploiting this vulnerability is severe and multifaceted, primarily centering on the compromise of user sessions and sensitive data integrity. An attacker leveraging this flaw can execute scripts to steal session cookies, effectively hijacking administrative accounts or privileged user identities without needing their passwords. This capability facilitates unauthorized access to backend systems, allowing for further lateral movement within the network infrastructure. Additionally, attackers may use the script execution to perform actions on behalf of victims, such as modifying settings, deleting content, or redirecting users to phishing sites designed to harvest credentials. The trust relationship between the user and the baserCMS application is fundamentally broken, leading to potential data breaches, reputational damage, and regulatory non-compliance regarding personal information protection standards like GDPR or CCPA.
In alignment with industry classification frameworks, this vulnerability maps directly to CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the sub-category of Stored XSS where malicious scripts are permanently stored on target servers. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework, this exploit aligns with techniques related to Client-side Execution and potentially Credential Access via Browser Session Hijacking if session tokens are targeted. Understanding these mappings helps security teams contextualize the risk profile and prioritize remediation efforts based on established threat intelligence models rather than treating it as an isolated incident.
To mitigate this vulnerability, developers must implement strict input validation and output encoding strategies across all form fields that handle user-supplied data. Input validation should enforce allow-listing for email formats to reject any characters or patterns indicative of script injection before the data is ever persisted to the database. More critically, output encoding must be applied dynamically based on the context in which the data is rendered; when displaying stored emails within HTML bodies, entities such as less-than and greater-than signs must be converted into their corresponding HTML entity equivalents. Implementing a Content Security Policy with strict script-src directives can also provide an additional layer of defense by restricting where scripts are allowed to execute from, thereby neutralizing many XSS attacks even if the underlying code flaw persists. Regular security audits and static application testing should be integrated into the development lifecycle to detect such encoding failures early.