{"id":"CVE-2020-15276","aliases":["GHSA-fw5q-j9p4-3vxg"],"url":"https://o3.security/vulnerability/CVE-2020-15276","summary":"Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0","details":"baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.","published":"2020-10-30T19:15:12.707Z","modified":"2026-07-09T01:31:34.270808Z","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"baserproject/basercms","fixedVersion":"4.4.1"}],"fix":{"url":"https://github.com/baserproject/basercms/commit/d14f506385f21d67d5ff3462f204d4c2321b7c54","label":"baserproject/basercms@d14f506"},"references":[{"type":"ADVISORY","url":"https://basercms.net/security/20201029"},{"type":"FIX","url":"https://github.com/baserproject/basercms/commit/d14f506385f21d67d5ff3462f204d4c2321b7c54"},{"type":"FIX","url":"https://github.com/baserproject/basercms/security/advisories/GHSA-fw5q-j9p4-3vxg"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T01:31:34.270808Z"}}