Description
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| baserproject | basercms | >= 4.0.0, < 4.4.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | baserproject/basercms | >= 4.4.0, < 4.4.1 | 4.4.1 | GHSA-fw5q-j9p4-3vxg |