PT-2025-43437 · Quick.Cms · Quick.Cms

Published 2025-10-23 · Updated 2025-11-17 · CVE-2025-9981

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions QuickCMS version 6.8

Description QuickCMS is susceptible to multiple Stored Cross-Site Scripting (XSS) issues within the slider editor functionality, specifically in the 'sliders-form' component. An attacker possessing administrative privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed on every page viewed by users. The vendor was notified of this issue but did not provide details regarding vulnerable version ranges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-9981

Affected Products

Quick.Cms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-9981 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9981 · Vendor Advisory
• https://t.me/cveNotify/139980 · Telegram Post
• https://twitter.com/CVEnew/status/1981297373545406948 · Twitter Post
• https://cert.pl/posts/2025/10/CVE-2025-9980 · Note
• https://twitter.com/VulmonFeeds/status/1981310304584626417 · Twitter Post
• https://t.me/cveNotify/143067 · Telegram Post
• https://opensolution.org/cms-system-quick-cms.html · Note