{"id":"CVE-2021-39136","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-39136","generatedAt":"2026-10-27T17:38:26.186Z","title":"In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS.","description":"baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.","published":"2021-08-25T18:15:07.000Z","lastModified":"2026-06-17T04:03:08.000Z","status":"Modified","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["basercms/basercms"],"epss":{"score":0.00929,"percentile":0.60316,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.93%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://jvn.jp/en/jp/JVN14134801/index.html","tags":["Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://basercms.net/security/JVN_14134801","tags":["Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc","tags":["Patch","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3","tags":["Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"http://jvn.jp/en/jp/JVN14134801/index.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://basercms.net/security/JVN_14134801","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-39136","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}