Loading story…
baserCMS disclosed and patched an OS command injection vulnerability in its update functionality that allowed an authenticated administrator to execute arbitrary operating system commands on the underlying server. The issue, tracked as CVE-2026-30877 and CVE-2026-21861, affects baserCMS versions prior to 5.2.3 and stems from insufficient validation of user-controlled input passed to the update process, including unsafe handling around exec().
The vulnerability is classified as CWE-78 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, reflecting high impact to confidentiality, integrity, and availability despite requiring administrator privileges. baserCMS addressed the flaw in version 5.2.3, with public references including the vendor security notice, the 5.2.3 release information, and a GitHub security advisory.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Public advisories disclosed two high-severity baserCMS vulnerabilities affecting versions prior to 5.2.3. Both issues were classified as CWE-78 command injection flaws with high-impact CVSS v3.1 scores and public references including a security notice, release page, and GitHub security advisory.
baserCMS patched OS command injection vulnerabilities in its update functionality in release 5.2.3. The flaws, later tracked as CVE-2026-30877 and CVE-2026-21861, could allow an authenticated administrator to execute arbitrary OS commands on the server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly recorded vulnerability, **CVE-2026-32968**, affects the `com_mb24sysapi` module and allows **unauthenticated remote code execution** through an OS command injection flaw. The weakness is classified as **CWE-78** and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of `CVE-2020-10383`, carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and is referenced by CERT VDE advisories **VDE-2026-024** and **VDE-2026-025**. A separate high-severity issue, **CVE-2026-29839**, was recorded for **DedeCMS v5.7.118** in the `/sys_task_add.php` component. The flaw is a **Cross-Site Request Forgery** vulnerability classified as **CWE-352**, and its updated **CVSS v3.1** vector is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
Jun 29, 2026
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026
Splunk disclosed a critical vulnerability in **Splunk AI Toolkit** that allows OS command injection through the `btool` Configuration Helper, affecting versions earlier than **5.7.4**. Tracked as **`CVE-2026-20266`** and rated **CVSS 9.1**, the flaw stems from unsafe shell execution that can let a user with the Splunk **admin** role run arbitrary commands on the host running Splunk Enterprise, creating a direct path to host compromise. Splunk also fixed **`CVE-2026-20265`**, a lower-severity insecure default domain allowlist issue rated **CVSS 4.3** that could allow a low-privileged user to trigger outbound HTTP requests and potentially exfiltrate data to an attacker-controlled server. The Canadian Centre for Cyber Security highlighted the vendor advisory in **AV26-614** and urged administrators to review Splunk’s guidance and upgrade to **version 5.7.4 or later**; public reporting said there was **no confirmed exploitation in the wild** at disclosure time.
Jul 12, 2026