A classic SQL injection flaw exists in the blog post editor of baserCMS 5.2.2 and earlier. Because the user input is incorporated into SQL statements without proper sanitisation, an attacker can inject arbitrary SQL code. The result is unauthorized reading, manipulation, or deletion of data from the baserCMS database, which undermines the confidentiality and integrity of all information stored in the system.

baserCMS, a web‐development framework produced by baserproject, is affected. Any installation running a release before 5.2.3 is vulnerable; version 5.2.3 and later contain the patch that removes the injection point.

The CVSS score of 6.9 classifies the vulnerability as moderate severity, and the EPSS score of less than 1% indicates a limited likelihood that it will be widely exploited today. The catalogue does not mark it as a known exploited vulnerability. The attack vector is inferred to be unauthenticated or low‑privilege users who can submit malicious payloads through the public blog post interface, enabling them to execute arbitrary SQL commands against the database.