CVE-2025-55175CWE-79cross-site-scripting

CVE-2025-55175

Medium · published August 28, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 16.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-28T15:15Z
Affected products (1)
ProductVersionsFixed in
opensolution/quick.cmsall versions—
References (2)
https://cert.pl/posts/2025/08/CVE-2025-54540 · [email protected]https://opensolution.org · [email protected]
EPSS history
Timeline
  • 28 AUG 10:12Z
    Reflected XSS in QuickCMS
    cvelistv5