SQL injection in baserCMS - CVE-2026-114621
Published: October 25, 2026
Vulnerability identifier: #VU157658
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114621
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL queries to disclose or modify database contents and disrupt database availability.
The vulnerability exists due to improper neutralization of SQL query elements in the list and detail actions of the baserCMS admin panel and admin API when passing request query parameters directly to the ORM as options. A remote user can embed SQL fragments in the contain, conditions, fields, finder, or order query parameters to execute arbitrary SQL, including reading password hashes from the users table.
Affected software
baserCMS
How to mitigate CVE-2026-114621
Install security update from vendor's website.
baserCMS - addressed in versions 5.3.2, 5.4.2