PT-2026-23669 · Quick.Cms · Quick.Cms

Michał Biesiada · Published 2026-03-06 · Updated 2026-03-06 · CVE-2026-1468

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions QuickCMS version 6.8 QuickCMS (affected versions not specified)

Description QuickCMS is susceptible to Cross-Site Request Forgery (CSRF) across multiple endpoints. An attacker can create a malicious website that, when visited by a victim, automatically submits POST requests with the victim’s permissions. The software lacks CSRF protection mechanisms, making all forms potentially vulnerable. The vendor was informed of this issue but did not provide details regarding vulnerable versions.

Recommendations Update to a newer version that contains a fix for this vulnerability. Implement CSRF protection mechanisms for all forms within the application.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-1468

Affected Products

Quick.Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1468 · Security Note
• https://cert.pl/posts/2026/03/CVE-2026-1468 · Note
• https://t.me/CVEtracker/46587 · Telegram Post
• https://opensolution.org/cms-system-quick-cms.html · Note
• https://twitter.com/CVEnew/status/2029975537326903418 · Twitter Post