Sync EUVD catalog: Wed Apr 1 00:39:43 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

advisories/2026/03/EUVD-2025-209130.json

@@ -1,14 +1,14 @@
 {
   "id": "EUVD-2025-209130",
   "enisaUuid": "3b4f22a0-365e-3871-ae27-5ae8406bb62b",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:43:48 AM",
-  "dateUpdated": "Mar 31, 2026, 12:43:48 AM",
+  "description": "baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)",
+  "datePublished": "Mar 31, 2026, 10:22:18 PM",
+  "dateUpdated": "Mar 31, 2026, 10:22:18 PM",
   "baseScore": 8.7,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7r\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
-  "aliases": "CVE-2025-32957\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-hv78-cwp4-8r7r\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-32957\n",
+  "aliases": "GHSA-hv78-cwp4-8r7r\nCVE-2025-32957\n",
   "assigner": "GitHub_M",
   "epss": 0.0,
   "enisaIdProduct": [

advisories/2026/03/EUVD-2025-209147.json

@@ -0,0 +1,31 @@
+{
+  "id": "EUVD-2025-209147",
+  "enisaUuid": "e2fb3e47-fef0-3ad4-916d-6c7ad9d12d69",
+  "description": "Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.  Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity is none.",
+  "datePublished": "Mar 31, 2026, 5:52:07 PM",
+  "dateUpdated": "Mar 31, 2026, 6:33:01 PM",
+  "baseScore": 4.8,
+  "baseScoreVersion": "4.0",
+  "baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+  "references": "https://support.pega.com/support-doc/pega-security-advisory-o25-vulnerability-remediation-note\n",
+  "aliases": "CVE-2025-62184\n",
+  "assigner": "Pega",
+  "epss": 0.0,
+  "enisaIdProduct": [
+    {
+      "id": "f9ef78fa-7818-3bad-ac3f-c6a88d15b575",
+      "product": {
+        "name": "Pega Infinity"
+      },
+      "product_version": "8.1.0 <Infinity 25.1.0"
+    }
+  ],
+  "enisaIdVendor": [
+    {
+      "id": "55c122e1-0130-374c-92d6-aa074773c4e5",
+      "vendor": {
+        "name": "Pegasystems"
+      }
+    }
+  ]
+}

advisories/2026/03/EUVD-2026-17255.json

@@ -1,13 +1,13 @@
 {
   "id": "EUVD-2026-17255",
   "enisaUuid": "fece7039-df6b-3da3-95b2-78892f5a7c41",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:43:58 AM",
-  "dateUpdated": "Mar 31, 2026, 12:43:58 AM",
+  "description": "baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)",
+  "datePublished": "Mar 31, 2026, 10:27:05 PM",
+  "dateUpdated": "Mar 31, 2026, 10:27:05 PM",
   "baseScore": 9.1,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-qxmc-6f24-g86g\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21861\n",
   "aliases": "CVE-2026-21861\n",
   "assigner": "GitHub_M",
   "epss": 0.0,

advisories/2026/03/EUVD-2026-17257.json

@@ -1,13 +1,13 @@
 {
   "id": "EUVD-2026-17257",
   "enisaUuid": "dd4823cb-00e0-31ac-8dcc-8e232cc9899e",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:44:20 AM",
-  "dateUpdated": "Mar 31, 2026, 12:44:20 AM",
+  "description": "baserCMS has an SQL injection vulnerability in its blog post functionality",
+  "datePublished": "Mar 31, 2026, 10:35:08 PM",
+  "dateUpdated": "Mar 31, 2026, 10:35:08 PM",
   "baseScore": 6.9,
   "baseScoreVersion": "4.0",
   "baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-vh89-rjph-2g7p\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-vh89-rjph-2g7p\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27697\n",
   "aliases": "CVE-2026-27697\n",
   "assigner": "GitHub_M",
   "epss": 0.0,

advisories/2026/03/EUVD-2026-17259.json

@@ -1,13 +1,13 @@
 {
   "id": "EUVD-2026-17259",
   "enisaUuid": "1ab37ae7-5325-38b4-8df1-250f04c94766",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:45:09 AM",
-  "dateUpdated": "Mar 31, 2026, 12:45:09 AM",
+  "description": "baserCMS Update Functionality Vulnerable to OS Command Injection",
+  "datePublished": "Mar 31, 2026, 10:35:47 PM",
+  "dateUpdated": "Mar 31, 2026, 10:35:47 PM",
   "baseScore": 9.1,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-m9g7-rgfc-jcm7\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-m9g7-rgfc-jcm7\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30877\n",
   "aliases": "CVE-2026-30877\n",
   "assigner": "GitHub_M",
   "epss": 0.0,

advisories/2026/03/EUVD-2026-17261.json

@@ -1,13 +1,13 @@
 {
   "id": "EUVD-2026-17261",
   "enisaUuid": "6bdf85d2-beef-3bc9-a4b2-2c716b54bb58",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:45:21 AM",
-  "dateUpdated": "Mar 31, 2026, 12:45:21 AM",
+  "description": "baserCMS has Mail Form Acceptance Bypass via Public API",
+  "datePublished": "Mar 31, 2026, 10:36:18 PM",
+  "dateUpdated": "Mar 31, 2026, 10:36:18 PM",
   "baseScore": 5.3,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-8cr7-r8qw-gp3c\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-8cr7-r8qw-gp3c\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30878\n",
   "aliases": "CVE-2026-30878\n",
   "assigner": "GitHub_M",
   "epss": 0.0,

advisories/2026/03/EUVD-2026-17263.json

@@ -1,14 +1,14 @@
 {
   "id": "EUVD-2026-17263",
   "enisaUuid": "7d3c1546-aedf-3e3d-9231-56f859cc81b1",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:45:50 AM",
-  "dateUpdated": "Mar 31, 2026, 12:45:50 AM",
+  "description": "baserCMS has a cross-site scripting vulnerability in blog posts",
+  "datePublished": "Mar 31, 2026, 10:43:10 PM",
+  "dateUpdated": "Mar 31, 2026, 10:43:10 PM",
   "baseScore": 6.9,
   "baseScoreVersion": "4.0",
   "baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-jmq3-x8q7-j9qm\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
-  "aliases": "CVE-2026-30879\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-jmq3-x8q7-j9qm\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30879\n",
+  "aliases": "CVE-2026-30879\nGHSA-jmq3-x8q7-j9qm\n",
   "assigner": "GitHub_M",
   "epss": 0.0,
   "enisaIdProduct": [

advisories/2026/03/EUVD-2026-17265.json

@@ -1,14 +1,14 @@
 {
   "id": "EUVD-2026-17265",
   "enisaUuid": "20a6b96d-54b8-3a21-bca5-107486d4b516",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:44:39 AM",
-  "dateUpdated": "Mar 31, 2026, 12:44:39 AM",
+  "description": "baserCMS has OS command injection vulnerability in installer",
+  "datePublished": "Mar 31, 2026, 10:43:31 PM",
+  "dateUpdated": "Mar 31, 2026, 10:43:31 PM",
   "baseScore": 9.2,
   "baseScoreVersion": "4.0",
   "baseScoreVector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-6hpg-8rx3-cwgv\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
-  "aliases": "CVE-2026-30880\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-6hpg-8rx3-cwgv\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30880\n",
+  "aliases": "GHSA-6hpg-8rx3-cwgv\nCVE-2026-30880\n",
   "assigner": "GitHub_M",
   "epss": 0.0,
   "enisaIdProduct": [

advisories/2026/03/EUVD-2026-17267.json

@@ -1,14 +1,14 @@
 {
   "id": "EUVD-2026-17267",
   "enisaUuid": "6ffa701f-4ec8-337b-92f7-1303f5c473ad",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:45:35 AM",
-  "dateUpdated": "Mar 31, 2026, 12:45:35 AM",
+  "description": "baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API",
+  "datePublished": "Mar 31, 2026, 10:47:39 PM",
+  "dateUpdated": "Mar 31, 2026, 10:47:39 PM",
   "baseScore": 7.2,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
-  "aliases": "CVE-2026-30940\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-c5c6-37vq-pjcq\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30940\n",
+  "aliases": "CVE-2026-30940\nGHSA-c5c6-37vq-pjcq\n",
   "assigner": "GitHub_M",
   "epss": 0.0,
   "enisaIdProduct": [

advisories/2026/03/EUVD-2026-17269.json

@@ -1,13 +1,13 @@
 {
   "id": "EUVD-2026-17269",
   "enisaUuid": "4d2c5da4-d73a-3be8-a684-534e7cf763e4",
-  "description": "baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3.",
-  "datePublished": "Mar 31, 2026, 12:46:43 AM",
-  "dateUpdated": "Mar 31, 2026, 12:46:43 AM",
+  "description": "baserCMS is Vulnerable to Cross-site Scripting",
+  "datePublished": "Mar 31, 2026, 10:52:07 PM",
+  "dateUpdated": "Mar 31, 2026, 10:52:07 PM",
   "baseScore": 7.1,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
-  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-677c-xv24-crgx\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\n",
+  "references": "https://github.com/baserproject/basercms/security/advisories/GHSA-677c-xv24-crgx\nhttps://basercms.net/security/JVN_20837860\nhttps://github.com/baserproject/basercms/releases/tag/5.2.3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32734\n",
   "aliases": "CVE-2026-32734\n",
   "assigner": "GitHub_M",
   "epss": 0.0,