CVE-2025-54540CWE-79cross-site-scripting

CVE-2025-54540

Medium · published August 28, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-28T15:15Z
Affected products (1)
ProductVersionsFixed in
opensolution/quick.cmsall versions—
References (2)
https://cert.pl/posts/2025/08/CVE-2025-54540 · [email protected]https://opensolution.org · [email protected]
EPSS history
Timeline
  • 28 AUG 10:12Z
    Reflected XSS in QuickCMS
    cvelistv5