PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-76635 baserproject CVE debrief

The CVE-2026-76635 vulnerability is a SQL injection flaw in baserCMS before version 5.3.0, located in BcDatabaseService.php. Authenticated administrators can exploit this vulnerability to inject malicious SQL table names and configuration values. A backup restore code injection flaw exists, allowing attackers to plant malicious table names and trigger error-based SQL injection to retrieve database information. This vulnerability has a high impact on affected systems, and administrators should take immediate action to update their installations. The CVE record was published on 2026-08-20T14:17:59.973Z and has not been modified since then. To verify the vulnerability, review the official CVE Program record and NIST NVD detail page for source-provided CVE metadata and vulnerability assessment.

Vendor
baserproject
Product
basercms
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-20
Original CVE updated
2026-08-25
Advisory published
2026-08-20
Advisory updated
2026-08-25

Who should care

Authenticated administrators of baserCMS versions prior to 5.3.0 should be aware of this vulnerability and take immediate action to update their installations. This involves reviewing the official advisory, planning vendor-supported updates or mitigations, and implementing compensating controls for exposed systems. Additionally, affected operators, platforms, vulnerability-management teams, and security teams should be informed of the potential impact and review context to ensure proper mitigation and remediation.

Technical summary

The CVE-2026-76635 vulnerability is a SQL injection flaw in baserCMS before version 5.3.0, located in BcDatabaseService.php. Authenticated administrators can exploit this vulnerability to inject malicious SQL table names and configuration values. Additionally, a backup restore code injection flaw exists, allowing attackers to plant malicious table names and trigger error-based SQL injection to retrieve database information.

Defensive priority

Authenticated administrators should urgently update baserCMS to version 5.3.0 or later to prevent SQL injection attacks.

Recommended defensive actions

  • Update baserCMS to version 5.3.0 or later immediately.
  • Restrict access to BcDatabaseService.php to only trusted administrators.
  • Monitor for suspicious SQL queries and database access patterns.
  • Implement additional security controls, such as web application firewalls and intrusion detection systems.
  • Conduct regular security audits and vulnerability assessments.

Evidence notes

The CVE-2026-76635 record indicates a SQL injection vulnerability in baserCMS before version 5.3.0, specifically in BcDatabaseService.php. Authenticated administrators are at risk as they can inject malicious table names and configuration values into SQL statements. A backup restore code injection flaw exists, allowing attackers to plant malicious table names and trigger error-based SQL injection to retrieve database information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-76635 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-76635

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-76635 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76635

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.