{"id":"CVE-2018-18942","aliases":["GHSA-rjc2-x53r-6c9r"],"url":"https://o3.security/vulnerability/CVE-2018-18942","summary":"RCE in baserCMS before 4.1.4","details":"In baserCMS before 4.1.4, lib\\Baser\\Model\\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.","published":"2018-11-05T09:29:00.557Z","modified":"2026-07-08T17:17:04.371672Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"baserproject/basercms","fixedVersion":"4.1.4"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://basercms.net/release/4_1_4"},{"type":"REPORT","url":"https://github.com/baserproject/basercms/issues/959"},{"type":"EVIDENCE","url":"http://sunu11.com/2018/10/31/baserCMS/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T17:17:04.371672Z"}}