CVE-2025-54542CWE-598

CVE-2025-54542

Medium · published August 28, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00135 · 2.7th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2025-08-28T15:15Z
Affected products (1)
ProductVersionsFixed in
opensolution/quick.cmsall versions—
References (2)
https://cert.pl/posts/2025/08/CVE-2025-54540 · [email protected]https://opensolution.org · [email protected]
EPSS history
Timeline
  • 28 AUG 10:12Z
    Sending Password in GET Request
    cvelistv5