https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T19:42:08.895780+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-97150 fkie_cve-2026-97150 2026-10-01T19:42:08.918354+00:00

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

 https://vulnerability.circl.lu/vuln/ghsa-m3wp-gxpc-2c5q GHSA-m3wp-gxpc-2c5q 2026-10-01T19:42:08.918510+00:00

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

 https://vulnerability.circl.lu/vuln/jvndb-2026-000138 jvndb-2026-000138 2026-10-01T19:42:08.918534+00:00

baserCMS plugin "BcAddonMigrator" provided by baserCMS Users Community contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/829.html' target='_blank'></a><ul><li>Inclusion of Functionality from Untrusted Control Sphere (CWE-829) - CVE-2026-97150</li></ul>Kuniyoshi Noguchi (KuniNogu) of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.