CVE-2025-54541

QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin-fetching mechanism. An attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. The issue was fixed in a patch to version 6.8 published on 15.05.2026.

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft a special website that, when visited by the victim, automatically sends a POST request with the victim's privileges. No protection is implemented. Fixed in version 6.8 (14.05.2026).

A Blind SQL injection vulnerability was identified in QuickCMS due to improper neutralization of input provided by a high-privileged user into aFilesDelete. The vendor did not respond; only version 6.8 was tested and confirmed vulnerable.

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

QuickCMS is vulnerable to multiple Stored XSS in the language editor functionality (languages). A malicious attacker with admin privileges can inject arbitrary HTML and JS into the website, which will be rendered/executed on every page. By default, an admin user is not able to add JavaScript into the website.

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

QuickCMS is vulnerable to reflected XSS via the sLangEdit parameter in the admin panel. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor did not respond; only version 6.8 was tested and confirmed vulnerable.

QuickCMS is vulnerable to Stored XSS via the aDirFilesDescriptions parameter in the files editor functionality. A malicious attacker with admin privileges can inject arbitrary HTML and JS into the website, which will be rendered/executed when visiting the edited page. By default, an admin user is not able to add JavaScript into the website.