A cross‑site scripting vulnerability via script validation bypass exists in baserCMS. An attacker can inject arbitrary JavaScript that will run in a victim’s browser when the content is displayed, enabling session hijacking, data theft, or defacement. The weakness is categorized as CWE‑79.

The flaw impacts the baserCMS web application; no specific product version is listed, so any deploying instance that has not applied a vendor patch may be susceptible.

The CVSS score of 5.1 indicates a moderate risk. The EPSS score of 0.00151 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on the attacker’s ability to submit or modify content that bypasses the script validation check, thereby executing malicious code in users’ browsers.