PT-2025-43436 · Quick.Cms · Quick.Cms

Published 2025-10-23 · Updated 2025-11-17 · CVE-2025-9980

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QuickCMS version 6.8 QuickCMS (affected versions not specified)

Description QuickCMS is susceptible to multiple Stored Cross-Site Scripting (XSS) issues within the page editor functionality, specifically in the 'pages-form' component. An attacker possessing administrative privileges can inject arbitrary HTML and JavaScript code into a website. This injected code will be rendered and executed when a user visits the modified page. By default, the administrative user is restricted from adding JavaScript to the website.

Recommendations QuickCMS version 6.8: Address the Stored XSS issue in the 'pages-form' component to prevent arbitrary HTML and JavaScript injection. QuickCMS (affected versions not specified): Address the Stored XSS issue in the 'pages-form' component to prevent arbitrary HTML and JavaScript injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-9980

Affected Products

Quick.Cms

References · 10

• https://osv.dev/vulnerability/CVE-2025-9980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9980 · Security Note
• https://t.me/cveNotify/139980 · Telegram Post
• https://t.me/cveNotify/143066 · Telegram Post
• https://twitter.com/CVEnew/status/1981297374552093062 · Twitter Post
• https://t.me/cveNotify/139979 · Telegram Post
• https://cert.pl/posts/2025/10/CVE-2025-9980 · Note
• https://twitter.com/VulmonFeeds/status/1981312864439677143 · Twitter Post
• https://t.me/cveNotify/143067 · Telegram Post
• https://opensolution.org/cms-system-quick-cms.html · Note