CVE-2025-54541CWE-352csrf

CVE-2025-54541

Medium · published August 28, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-08-28T15:15Z
Affected products (1)
ProductVersionsFixed in
opensolution/quick.cmsall versions—
References (2)
https://cert.pl/posts/2025/08/CVE-2025-54540 · [email protected]https://opensolution.org · [email protected]
EPSS history
Timeline
  • 28 AUG 10:12Z
    Cross-Site Request Forgery in QuickCMS
    cvelistv5