PT-2025-46952 · Quick.Cms · Quick.Cms

Karol Czubernat · Published 2025-11-14 · Updated 2025-11-14 · CVE-2025-10018

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions QuickCMS version 6.8 QuickCMS (affected versions not specified)

Description QuickCMS is susceptible to multiple Stored Cross-Site Scripting (XSS) issues within the language editor functionality, specifically in the 'languages' section. An attacker possessing administrative privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed on every page viewed by users. The vendor was informed of this issue but did not provide details regarding vulnerable version ranges. While version 6.8 was confirmed as vulnerable, other versions have not been tested and may also be affected.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10018

Affected Products

Quick.Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10018 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10018 · Vendor Advisory
• https://t.me/CVEtracker/37328 · Telegram Post
• https://cert.pl/posts/2025/11/CVE-2025-9982 · Note
• https://twitter.com/CVEnew/status/1989355879490376042 · Twitter Post
• https://opensolution.org/cms-system-quick-cms.html · Note
• https://t.me/cveNotify/142783 · Telegram Post