Opensolution Quickcms
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Opensolution Quickcms.
By the Year
In 2026 there have been 7 vulnerabilities in Opensolution Quickcms with an average score of 5.1 out of ten. Last year, in 2025 Quickcms had 6 security vulnerabilities published. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 7 | 5.10 |
| 2025 | 6 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 3 | 5.40 |
It may take a day or so for new Quickcms vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Opensolution Quickcms Security Vulnerabilities
Quick.CMS Path Traversal via unnormalized '../' in URI
CVE-2026-63303
- July 28, 2026
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Relative Path Traversal
Quick.CMS LFI in admin.php: Remote Path Disclosure via p Param
CVE-2026-63302
- July 28, 2026
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure). The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Remote file include
Quick.CMS Admin API Bypass Enables Primary Language Deletion DoS (CSRF)
CVE-2026-63301
- July 28, 2026
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application. Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Client-Side Enforcement of Server-Side Security
Quick.CMS 6.8 RCE via deserialization of untrusted payload over HTTP
CVE-2026-11860
- June 15, 2026
Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel. When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel. This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.
Marshaling, Unmarshaling
CVE-2026-33386 QuickCMS <6.8 XSS via insecure HTTP pluginfetch - MITM
CVE-2026-33386
- May 29, 2026
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based pluginfetching mechanism. A malicious attacker can perform a ManintheMiddle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. When a user accesses the plugin page, the malicious content is automatically fetched, rendered, and executed. This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.
XSS
QuickCMS 6.X Session ID Fixation before Authentication (CVE-2026-33384)
CVE-2026-33384
- May 29, 2026
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.
Session Fixation
QuickCMS 6.8: CSRF Vulnerability Across Endpoints
CVE-2026-1468
5.1 - Medium
- March 06, 2026
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable
Session Riding
Quick.CMS 6.7 SQLi via Login Form Unauthorized Admin Access
CVE-2024-58308
- December 11, 2025
Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.
SQL Injection
QuickCMS v6.8 Blind SQL Injection via aFilesDelete
CVE-2025-12465
- December 02, 2025
A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
SQL Injection
QuickCMS <=6.8 XSS via language editor (admin)
CVE-2025-10018
- November 14, 2025
QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
XSS
QuickCMS 6.8 Credential Exposure via Hardcoded Config
CVE-2025-9982
- November 14, 2025
A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Unprotected Storage of Credentials
QuickCMS 6.8 Stored XSS in slidersform editor
CVE-2025-9981
- October 23, 2025
QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
XSS
QuickCMS 6.8 Stored XSS: page editor pages-form
CVE-2025-9980
- October 23, 2025
QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
XSS
XSS in opensolution Quick CMS 6.7 Languages Menu Backend Dashboard
CVE-2023-43346
5.4 - Medium
- October 20, 2023
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend - Dashboard parameter in the Languages Menu component.
XSS
XSS in OpenSolution QuickCMS 6.7 Pages Menu via SEO Meta
CVE-2023-43344
5.4 - Medium
- October 19, 2023
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Meta description parameter in the Pages Menu component.
XSS
OpenSolution QuickCMS 6.7 XSS via PagesMenu FilesDesc Param
CVE-2023-43343
5.4 - Medium
- October 05, 2023
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files - Description parameter in the Pages Menu component.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Opensolution Quickcms or by Opensolution? Click the Watch button to subscribe.
