Karol Czubernat

**Name of the Vulnerable Software and Affected Versions** Quick.Cart (affected versions not specified) **Description** Quick.Cart stores hard-coded, plaintext admin credentials within a configuration file. This flaw allows attackers who have access to the server file system to retrieve these authentication details, which could lead to privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Quick.CMS (affected versions not specified) **Description** A Path Traversal issue exists where the server fails to normalize dot-dot-slash (../) sequences in the URI path component of HTTP requests before resolving and serving the requested file. An authenticated attacker with admin privileges can exploit this by sending a crafted HTTP request containing these sequences to read files located in the sibling directory of the webroot. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Quick.CMS (affected versions not specified) **Description** Local File Inclusion (LFI) exists in the 'admin.php' endpoint through the `p` parameter. An authenticated attacker with admin privileges can include arbitrary files from the application directory via a crafted HTTP request, leading to path disclosure, which reveals the server's absolute file paths and directory structure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application. Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 **Description** An authenticated attacker can upload arbitrary files, including PHP scripts, because the system does not validate the types of uploaded files. This flaw can lead to Remote Code Execution (RCE), which allows an attacker to execute arbitrary commands on the server. There have been reports of elevated activities targeting this software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS is susceptible to a Cross-Site Request Forgery (CSRF) issue within the user editing functionality. A malicious actor can create a specially crafted website that, when accessed by a victim, automatically submits a POST request to delete a specified user. The vendor was informed of this issue but did not provide details regarding vulnerable versions or a response. **Recommendations** Apply a fix for Windu CMS version 4.1. Address the Cross-Site Request Forgery issue in all other potentially vulnerable versions of Windu CMS.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS has a flaw that allows attackers to perform Cross-Site Request Forgery (CSRF) attacks in the user editing functionality. The existing CSRF protection can be circumvented by utilizing the CSRF token from another user. Registration is open to anyone, allowing for easy account creation. **Recommendations** Apply a fix for Windu CMS version 4.1. Implement a robust CSRF protection mechanism that prevents the use of CSRF tokens from other users.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS has a flaw related to access control in the user editing feature. An attacker with sufficient privileges can send a GET request to delete Super Admins, a function not normally accessible through the graphical user interface. The vendor was informed of this issue but did not provide details about vulnerable versions. **Recommendations** Apply any available updates or patches for Windu CMS version 4.1. For other versions, implement strict access controls and regularly review user privileges.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS has a weak client-side brute-force protection mechanism. The system utilizes the `loginError` parameter, but does not store attempt counts or timeouts server-side. This allows an attacker to bypass the brute-force protection by resetting the `loginError` parameter. The vendor was notified of this issue but did not provide details regarding vulnerable versions. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the login functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS is susceptible to a Cross-Site Request Forgery (CSRF) issue within its file uploading functionality. A malicious actor can create a specially crafted website that, when accessed by a victim, will automatically send a malicious file to the server. The vendor was informed of this issue but did not provide details regarding vulnerable versions. **Recommendations** Apply a fix for Windu CMS version 4.1. For other versions, apply a fix when available.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS is susceptible to Stored Cross-Site Scripting (XSS) in the logon page due to inadequate input validation. A malicious actor can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when an administrator visits the logs page. **Recommendations** Apply appropriate input validation to all user-supplied data on the logon page.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS is susceptible to User Enumeration. During the login process, differing messages can reveal whether a login attempt is valid, potentially enabling a brute force attack utilizing valid credentials. The vendor was informed of this issue but did not provide details regarding vulnerable versions. Testing confirmed version 4.1 as vulnerable, and other versions may also be affected. **Recommendations** Versions prior to version 4.1 should be considered vulnerable and investigated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windu CMS version 4.1 Windu CMS (affected versions not specified) **Description** Windu CMS has multiple Stored Cross-Site Scripting (XSS) issues in the page editing endpoint ''/windu/admin/content/pages/edit/''. A user with privileges can exploit this to potentially target users with higher privileges. The vendor was notified but did not provide details about vulnerable versions. **Recommendations** Update to a newer version of Windu CMS that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickCMS version 6.8 **Description** A flaw exists where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuickCMS version 6.8 QuickCMS (affected versions not specified) **Description** QuickCMS is susceptible to multiple Stored Cross-Site Scripting (XSS) issues within the language editor functionality, specifically in the 'languages' section. An attacker possessing administrative privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed on every page viewed by users. The vendor was informed of this issue but did not provide details regarding vulnerable version ranges. While version 6.8 was confirmed as vulnerable, other versions have not been tested and may also be affected. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to a Cross-Site Request Forgery (CSRF) issue in the page deletion functionality. A malicious actor can create a crafted website that, when visited by an administrator, automatically sends a POST request to delete an article. The vendor was notified of this issue but did not provide details regarding vulnerable version ranges. Recommendations: Apply any available updates or patches for QuickCMS version 6.8 to address the CSRF issue in the page deletion functionality.

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to Reflected Cross-Site Scripting (XSS) through the `sSort` parameter within the admin panel functionality. An attacker can leverage this to execute arbitrary JavaScript code in a victim’s browser by crafting a malicious URL. Recommendations: QuickCMS version 6.8: Address the issue by sanitizing user input for the `sSort` parameter to prevent the injection of malicious scripts.

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to Reflected Cross-Site Scripting (XSS) via the `sLangEdit` parameter within the admin panel functionality. An attacker can create a malicious URL that, when accessed, can execute arbitrary JavaScript code in a victim’s browser. Recommendations: Update to a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to a Stored Cross-Site Scripting (XSS) issue through the `sDescriptionMeta` parameter within the page editor's SEO functionality. An attacker possessing administrative privileges can inject arbitrary HTML and JavaScript code into a website. This injected code will be rendered and executed when a user visits the modified page. By default, the admin user is not able to add JavaScript into the website. Recommendations: Update to a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to a Stored Cross-Site Scripting (XSS) issue through the `aDirFilesDescriptions` parameter within the files editor functionality. An attacker with administrative privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when a user visits the modified page. By default, the administrative user is restricted from adding JavaScript to the website. Recommendations: Update to a newer version that contains a fix for this issue.