LightNews — News, ranked by scholars

Multiple Stored XSS in QuickCMSQuickCMS is vulnerable to multiple Stored XSS ... QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with ...

Origin | Interest | Match

CVE-2025-10018 | THREATINT

CVE-2025-10018: QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able ...

cve.threatint.eu

November 14, 2025 at 4:08 PM

FunctionalProgramming

@functionalprogramming.activitypub.awakari.com.ap.brid.gy

Multiple Stored XSS in QuickCMSQuickCMS is vulnerable to multiple Stored XSS ... QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with...

Origin | Interest | Match

CVE-2025-9981 | THREATINT

CVE-2025-9981: QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able ...

cve.threatint.eu

October 23, 2025 at 10:46 AM

FunctionalProgramming

@functionalprogramming.activitypub.awakari.com.ap.brid.gy

Reflected XSS in QuickCMSQuickCMS is vulnerable to Reflected XSS via sLangEdi... QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious att...

Origin | Interest | Match

CVE-2025-55175 | THREATINT

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this...

cve.threatint.eu

August 28, 2025 at 11:01 AM

CVE Alerts

@cve.skyfleet.blue

CVE-2026-1468 - Cross-Site Request Forgery in QuickCMS
CVE ID : CVE-2026-1468

Published : March 6, 2026, 11:16 a.m. | 31 minutes ago

Description : QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which...

CVE-2026-1468 - Cross-Site Request Forgery in QuickCMS

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are …

cvefeed.io

March 6, 2026 at 11:54 AM

CVE Alerts

@cve.skyfleet.blue

CVE-2025-10018 - Multiple Stored XSS in QuickCMS
CVE ID : CVE-2025-10018

Published : Nov. 14, 2025, 2:15 p.m. | 28 minutes ago

Description : QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileg...

CVE-2025-10018 - Multiple Stored XSS in QuickCMS

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. The vendor was notified early …

cvefeed.io

November 14, 2025 at 3:04 PM

CVE Alerts

@cve.skyfleet.blue

CVE-2025-9982 - Hard-coded admin credentials in Quick.CMS
CVE ID : CVE-2025-9982

Published : Nov. 14, 2025, 2:15 p.m. | 28 minutes ago

Description : A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and...

CVE-2025-9982 - Hard-coded admin credentials in Quick.CMS

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor was notified early …

cvefeed.io

November 14, 2025 at 2:59 PM

CVE Alerts

@cve.skyfleet.blue

CVE-2025-9980 - Multiple Stored XSS in QuickCMS
CVE ID : CVE-2025-9980

Published : Oct. 23, 2025, 10:15 a.m. | 27 minutes ago

Description : QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges c...

CVE-2025-9980 - Multiple Stored XSS in QuickCMS

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified …

cvefeed.io

October 23, 2025 at 11:00 AM

CVE Alerts

@cve.skyfleet.blue

CVE-2025-9981 - Multiple Stored XSS in QuickCMS
CVE ID : CVE-2025-9981

Published : Oct. 23, 2025, 10:15 a.m. | 27 minutes ago

Description : QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileg...

CVE-2025-9981 - Multiple Stored XSS in QuickCMS

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. The vendor was notified early …

cvefeed.io

October 23, 2025 at 10:50 AM

EUVD Bot

@euvd-bot.bsky.social

🚨 EUVD-2026-33338
📊 4.8/10
🏢 OpenSolution

📝 QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This b...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33338

#cybersecurity #infosec #cve #euvd

May 29, 2026 at 5:00 PM

EUVD Bot

@euvd-bot.bsky.social

🚨 EUVD-2026-33339
📊 2.3/10
🏢 OpenSolution

📝 QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can perform a Ma...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33339

#cybersecurity #infosec #cve #euvd

May 29, 2026 at 5:00 PM

EUVD Bot

@euvd-bot.bsky.social

🚨 EUVD-2026-10028
📊 5.1/10
🏢 OpenSolution

📝 QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the vict...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10028

#cybersecurity #infosec #cve #euvd

March 6, 2026 at 12:01 PM

2rZiKKbOU3nTafniR2qMMSE0gwZ

@2rzikkbou3ntafnir2qmmse0gwz.activitypub.awakari.com.ap.brid.gy

Cross-Site Request Forgery in QuickCMSQuickCMS is vulnerable to Cross-Site Re... QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special websit...

Origin | Interest | Match

CVE-2026-1468 | THREATINT

CVE-2026-1468: QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protect...

cve.threatint.eu

March 6, 2026 at 11:36 AM

cyberowi.pl

@cyberowi.pl

🚨 CVE-2025-12465: Blind SQL Injection w systemie QuickCMS

W popularnym systemie CMS QuickCMS w wersji 6.8 wykryto podatność CVE-2025-12465. Umożliwia ona ataki typu Blind SQL Injection, a producent

https://cyberowi.pl/cve-2025-12465-blind-sql-injection-w-systemie-quickcms/

#cyberbezpieczenstwo

May 20, 2026 at 7:37 AM

Add to Home Screen

News, ranked by scholars

Sign in to LightNews

Sign up to start reading

Connect Bluesky

Connect with Bluesky