PT-2026-23669 · Quick.Cms · Quick.Cms

Michał Biesiada · Publicado 2026-03-06 · Atualizado 2026-03-06 · CVE-2026-1468

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions QuickCMS version 6.8 QuickCMS (affected versions not specified)

Description QuickCMS is susceptible to Cross-Site Request Forgery (CSRF) across multiple endpoints. An attacker can create a malicious website that, when visited by a victim, automatically submits POST requests with the victim’s permissions. The software lacks CSRF protection mechanisms, making all forms potentially vulnerable. The vendor was informed of this issue but did not provide details regarding vulnerable versions.

Recommendations Update to a newer version that contains a fix for this vulnerability. Implement CSRF protection mechanisms for all forms within the application.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-1468

Produtos afetados

Quick.Cms

Referências · 5

• https://cert.pl/posts/2026/03/CVE-2026-1468 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1468 · Nota de Segurança
• https://t.me/CVEtracker/46587 · Publicação no Telegram
• https://opensolution.org/cms-system-quick-cms.html · Nota
• https://twitter.com/CVEnew/status/2029975537326903418 · Publicação no Twitter