CVE-2023-43649

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-43654.3Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a CVE-2023-436507.4JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to t CVE-2023-436519.9JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary comman CVE-2023-436529.1JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an CVE-2023-436549.8TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, e CVE-2023-436558.8Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be CVE-2023-436569.0matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transfo CVE-2023-436576.1discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles co CVE-2023-436586.1dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of CVE-2023-436595.4Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via CVE-2023-43668.8Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extensi CVE-2023-436608.1Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user c