Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

47 records

Vendor: OpenSolution Clear all filters
TI-2026-25782 CVE-2026-33385 · GHSA-cjf9-hgp6-3h22

Blind SQL Injection in Quick.CMS

Priority LOW 23

A Blind SQL injection vulnerability has been identified in Quick.CMS.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00407 Published 2026-07-29 No fix listed CWE-89
TI-2026-30279 CVE-2026-41874 · GHSA-5v73-8v9g-j67x

Hard-coded admin credentials in Quick.Cart

Priority LOW 29

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00181 Published 2026-07-28 No fix listed CWE-256
TI-2026-45149 CVE-2026-63303 · GHSA-5wcv-j62r-8fp5

Path Traversal in Quick.CMS

Priority LOW 24

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00574 Published 2026-07-28 No fix listed CWE-23
TI-2026-45148 CVE-2026-63302 · GHSA-87pr-j64q-3qv5

Local File Inclusion in Quick.CMS

Priority LOW 24

Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00528 Published 2026-07-28 No fix listed CWE-98
TI-2026-45147 CVE-2026-63301 · GHSA-4pmv-mf66-4v3h

Denial of Service in Quick.CMS

Priority LOW 32

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce…

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00575 Published 2026-07-28 No fix listed CWE-602
TI-2026-25783 CVE-2026-33386 · GHSA-wq6v-xp72-v7h5

XSS in QuickCMS

Priority LOW 11

QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00185 Published 2026-05-29 No fix listed CWE-79
TI-2026-25781 CVE-2026-33384 · GHSA-x6p9-8crm-x3hf

Session Fixation in QuickCMS

Priority LOW 21

QuickCMS allows a user's session identifier to be set before authentication.

CVSS 4.0MEDIUM 4.8 Local No auth User interaction EPSS 0.00154 Published 2026-05-29 No fix listed CWE-384
TI-2021-22594 CVE-2021-47981 · GHSA-g33h-xxgx-7c28

Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form

Priority MEDIUM 56

Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00178 Published 2026-05-16 No fix listed CWE-79
TI-2026-01165 CVE-2026-1468 · GHSA-9mjh-488m-qp5f

Cross-Site Request Forgery in QuickCMS

Priority LOW 23

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00231 Published 2026-03-06 No fix listed CWE-352
TI-2026-19162 CVE-2026-23796 · GHSA-rfjq-chwp-46m7

Session Fixation in Quick.Cart

Priority LOW 22

Quick.Cart allows a user's session identifier to be set before authentication.

CVSS 4.0MEDIUM 4.8 Local No auth User interaction EPSS 0.00307 Published 2026-02-05 No fix listed CWE-384
TI-2026-19163 CVE-2026-23797 · GHSA-jf4c-6xg3-hjc6

Plaintext password display in Quick.Cart

Priority LOW 36

In Quick.Cart user passwords are stored in plaintext form.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00291 Published 2026-02-05 No fix listed CWE-256
TI-2025-41398 CVE-2025-67684 · GHSA-jchx-26cr-w8w2

Remote Code Execution via Local File Inclusion in Quick.Cart

Priority MEDIUM 44

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.0082 Published 2026-01-22 No fix listed CWE-22
TI-2025-41397 CVE-2025-67683 · GHSA-x95g-m33x-ggjj

Reflected XSS in Quick.Cart

Priority LOW 23

Quick.Cart is vulnerable to reflected XSS via the sSort parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00282 Published 2026-01-22 No fix listed CWE-79
TI-2024-38405 CVE-2024-58308 · GHSA-xrmh-cph2-4343

Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login

Priority HIGH 81

Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00666 Published 2025-12-11 No fix listed CWE-89
TI-2025-11438 CVE-2025-12465 · GHSA-fpxj-733r-46hx

Blind SQL Injection in QuickCMS

Priority LOW 37

A Blind SQL injection vulnerability has been identified in QuickCMS.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00295 Published 2025-12-02 No fix listed CWE-89
TI-2025-09195 CVE-2025-10018 · GHSA-fgc5-56hp-fm3c

Multiple Stored XSS in QuickCMS

Priority LOW 21

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages).

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0021 Published 2025-11-14 No fix listed CWE-79
TI-2025-09162 CVE-2025-9982 · GHSA-567h-vqw8-c72f

Hard-coded admin credentials in Quick.CMS

Priority LOW 32

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00283 Published 2025-11-14 No fix listed CWE-256
TI-2025-09466 CVE-2025-10317 · GHSA-6v27-vrfr-9j74

Multiple Cross-Site Request Forgery in Quick.Cart

Priority LOW 23

Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00212 Published 2025-10-30 No fix listed CWE-352
TI-2025-09161 CVE-2025-9981 · GHSA-2hmv-pxch-4v62

Multiple Stored XSS in QuickCMS

Priority LOW 21

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form).

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0021 Published 2025-10-23 No fix listed CWE-79
TI-2025-09160 CVE-2025-9980 · GHSA-q24c-8f3w-h9g2

Multiple Stored XSS in QuickCMS

Priority LOW 21

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form).

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0021 Published 2025-10-23 No fix listed CWE-79
TI-2025-34856 CVE-2025-55175 · GHSA-55hp-hjjj-m6wh

Reflected XSS in QuickCMS

Priority LOW 23

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.003 Published 2025-08-28 No fix listed CWE-79
TI-2025-34328 CVE-2025-54544 · GHSA-66vp-qvgr-c38p

Stored XSS in QuickCMS

Priority LOW 24

QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00231 Published 2025-08-28 No fix listed CWE-79
TI-2025-34327 CVE-2025-54543 · GHSA-qwgj-xc9p-g242

Stored XSS in QuickCMS

Priority LOW 24

QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00231 Published 2025-08-28 No fix listed CWE-79
Load more