CVE-2026-93464 in BaserCMS
Summary
by MITRE • 09/30/2026
Stored Cross-Site Scripting via custom content descriptions vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability represents a Stored Cross-Site Scripting flaw within the baserCMS platform, specifically triggered through the manipulation of custom content descriptions. This type of security defect falls under the category of CWE-79, which classifies improper neutralization of input during web page generation as known cross-site scripting weakness. Unlike reflected XSS where malicious scripts are executed immediately via a crafted link, stored vulnerabilities persist within the application's data store, such as a database or file system. In this specific instance, an attacker can inject executable JavaScript code into the custom content description fields. Because baserCMS processes and renders these descriptions for display to other users without adequate sanitization or encoding of special characters like angle brackets, quotes, and ampersands, the malicious payload becomes part of the stored data structure itself.
When a legitimate user accesses a page containing this compromised content, their web browser interprets the injected script as valid code belonging to the application's domain. This execution context allows the attacker to bypass same-origin policy restrictions, granting them significant capabilities within the victim's session environment. The operational impact of such an exploit is severe and multifaceted. Attackers can perform actions on behalf of the user, including reading sensitive cookies or local storage data that contain authentication tokens or personal information. Furthermore, they can manipulate the DOM to alter page content, redirect users to phishing sites designed to steal credentials, or deface the website interface. In more sophisticated scenarios, this vulnerability serves as a vector for session hijacking, allowing the attacker to take full control of the victim's account within the CMS environment.
The persistence of this threat means that every user who views the affected content is potentially exposed, amplifying the blast radius significantly compared to one-time exploits. This aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution in web browsers, and often facilitates subsequent techniques such as Credential Access via Browser Session Hijacking (T1539) or Collection of Data from Local System if the script can access local storage APIs. The root cause lies in insufficient input validation on the server side when accepting user-supplied data for custom content descriptions, coupled with a lack of output encoding when rendering that data back to the client.
To mitigate this vulnerability, developers must implement strict input validation and robust output encoding strategies. All special characters within user-provided fields should be HTML-encoded or escaped before being stored in the database and again before being rendered in the browser response. Implementing a Content Security Policy (CSP) header can also provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby preventing inline script execution even if injection occurs. Additionally, using modern web frameworks that automatically handle escaping or employing dedicated sanitization libraries like DOMPurify can significantly reduce the risk of XSS attacks. Regular security audits and penetration testing focused on input handling in CMS modules are essential to identify and remediate such flaws before they can be exploited by malicious actors.