CVE-2026-76635

{"id": "CVE-2026-76635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76635", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:38:35.215463Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/baserproject/basercms", "vendor": "baserproject", "product": "basercms", "versions": [{"status": "affected", "version": "0", "lessThan": "5.3.0", "versionType": "semver"}], "packageURL": "pkg:github/baserproject/basercms", "defaultStatus": "affected"}]}], "published": "2026-08-20T14:17:59.973", "references": [{"url": "https://github.com/baserproject/basercms/releases/tag/5.3.0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/baserproject/basercms/security/advisories/GHSA-cg65-f2m7-9fqj", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/basercms-sql-injection-and-code-injection-via-bcdatabaseservice-php", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/baserproject/basercms/security/advisories/GHSA-cg65-f2m7-9fqj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend."}, {"lang": "es", "value": "baserCMS antes de 5.3.0 contiene una vulnerabilidad de inyecci\u00f3n SQL en BcDatabaseService.php que permite a los administradores autenticados inyectar nombres de tabla y valores de configuraci\u00f3n controlados por el atacante directamente en sentencias SQL a trav\u00e9s de operaciones de actualizaci\u00f3n de secuencia, exportaci\u00f3n CSV y gesti\u00f3n de tablas. Los atacantes pueden encadenar un fallo de inyecci\u00f3n de c\u00f3digo en la restauraci\u00f3n de copias de seguridad, donde el c\u00f3digo PHP fuera de las definiciones de clase en los archivos de esquema se ejecuta incondicionalmente al cargarse, para insertar nombres de tabla maliciosos y desencadenar una inyecci\u00f3n SQL basada en errores que recupera la versi\u00f3n de la base de datos, el contenido del esquema y datos arbitrarios del backend de PostgreSQL."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "disclosure@vulncheck.com"}