PT-2025-34986 · Quick.Cms · Quick.Cms

Karol Czubernat · Published 2025-08-28 · Updated 2025-09-08 · CVE-2025-54544

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8

Description: QuickCMS is susceptible to a Stored Cross-Site Scripting (XSS) issue through the aDirFilesDescriptions parameter within the files editor functionality. An attacker with administrative privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when a user visits the modified page. By default, the administrative user is restricted from adding JavaScript to the website.

Recommendations: Update to a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54544

Affected Products

Quick.Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-54544 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54544 · Vendor Advisory
• https://twitter.com/CVEnew/status/1961015324331081868 · Twitter Post
• https://t.me/cveNotify/134655 · Telegram Post
• https://cert.pl/posts/2025/08/CVE-2025-54540 · Note
• https://twitter.com/VulmonFeeds/status/1961036815474757811 · Twitter Post
• https://opensolution.org · Note