PT-2025-32178 · Qcms · Qcms

Xiaoyang · CVE-2025-50233 · Published 2025-08-06 · Updated 2025-08-06

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QCMS version 6.0.5

Description A vulnerability allows authenticated users to read arbitrary files from the server due to insufficient validation of the Name parameter in the backend template editor. Attackers can manipulate this parameter to perform directory traversal and access sensitive files outside the intended template directory, potentially exposing system configuration or PHP source code.

Recommendations Ensure proper validation of the Name parameter in the backend template editor.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-50233

Affected Products

Qcms

References · 7

• 🔥 https://github.com/xiaoyangsec/cve/blob/main/README.md · Exploit
• 🔥 https://github.com/xiaoyangsec/cve · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50233 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50233 · Vendor Advisory
• https://t.me/CVEtracker/29358 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1953173207004926299 · Twitter Post
• https://twitter.com/CVEnew/status/1953113726116155613 · Twitter Post