CVE-2025-9980CWE-79cross-site-scripting

CVE-2025-9980

Medium · published October 23, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-23T14:15Z
Affected products (1)
ProductVersionsFixed in
opensolution/quick.cmsall versions—
References (2)
https://cert.pl/posts/2025/10/CVE-2025-9980 · [email protected]https://opensolution.org/cms-system-quick-cms.html · [email protected]
EPSS history
Timeline
  • 23 OCT 09:37Z
    Multiple Stored XSS in QuickCMS
    cvelistv5