Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

15 records

Vendor: OpenSolution Component: Quick.cms Clear all filters
TI-2025-09195 CVE-2025-10018 · GHSA-fgc5-56hp-fm3c

Multiple Stored XSS in QuickCMS

Priority LOW 21

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages).

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0021 Published 2025-11-14 No fix listed CWE-79
TI-2025-09162 CVE-2025-9982 · GHSA-567h-vqw8-c72f

Hard-coded admin credentials in Quick.CMS

Priority LOW 32

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00283 Published 2025-11-14 No fix listed CWE-256
TI-2025-09161 CVE-2025-9981 · GHSA-2hmv-pxch-4v62

Multiple Stored XSS in QuickCMS

Priority LOW 21

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form).

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0021 Published 2025-10-23 No fix listed CWE-79
TI-2025-09160 CVE-2025-9980 · GHSA-q24c-8f3w-h9g2

Multiple Stored XSS in QuickCMS

Priority LOW 21

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form).

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0021 Published 2025-10-23 No fix listed CWE-79
TI-2025-34856 CVE-2025-55175 · GHSA-55hp-hjjj-m6wh

Reflected XSS in QuickCMS

Priority LOW 23

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.003 Published 2025-08-28 No fix listed CWE-79
TI-2025-34328 CVE-2025-54544 · GHSA-66vp-qvgr-c38p

Stored XSS in QuickCMS

Priority LOW 24

QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00231 Published 2025-08-28 No fix listed CWE-79
TI-2025-34327 CVE-2025-54543 · GHSA-qwgj-xc9p-g242

Stored XSS in QuickCMS

Priority LOW 24

QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00231 Published 2025-08-28 No fix listed CWE-79
TI-2025-34326 CVE-2025-54542 · GHSA-xwpr-8r3x-2877

Sending Password in GET Request

Priority LOW 35

QuickCMS sends password and login via GET Request.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00135 Published 2025-08-28 No fix listed CWE-598
TI-2025-34325 CVE-2025-54541 · GHSA-7jrp-8f7v-p43h

Cross-Site Request Forgery in QuickCMS

Priority LOW 36

QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00169 Published 2025-08-28 No fix listed CWE-352
TI-2025-34324 CVE-2025-54540 · GHSA-h6m8-w6h5-f84w

Reflected XSS in QuickCMS

Priority LOW 23

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.003 Published 2025-08-28 No fix listed CWE-79
TI-2025-34015 CVE-2025-54174 · GHSA-hq3v-wmv5-pcgj

Cross-Site Request Forgery in QuickCMS

Priority LOW 22

QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00155 Published 2025-08-20 No fix listed CWE-352
TI-2025-34014 CVE-2025-54172 · GHSA-2vv3-hgv2-fhhm

Stored Cross-Site Scripting in QuickCMS

Priority LOW 21

QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00229 Published 2025-08-20 No fix listed CWE-79
TI-2009-03910 CVE-2009-4121 · GHSA-966q-pqww-2262

Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and…

Priority LOW 31

Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete web pages via a p-d…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00649 Published 2009-12-01 No fix listed CWE-352