CVE-2025-9982
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Risk Assessment
The risk includes the possibility of an attacker obtaining admin credentials, which could lead to full system compromise and privilege escalation.
Recommendation
It is recommended to immediately change admin passwords, remove hardcoded credentials from configuration files, and apply patches or consider migrating to a more secure system.
Other vulnerabilities in QuickCMS
See all- CVE-2026-33386Low
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin-fetching mechanism. An attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. The issue was fixed in a patch to version 6.8 published on 15.05.2026.
- CVE-2026-33384Medium
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.
- CVE-2026-1468Medium
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft a special website that, when visited by the victim, automatically sends a POST request with the victim's privileges. No protection is implemented. Fixed in version 6.8 (14.05.2026).
- CVE-2025-10018Medium
QuickCMS is vulnerable to multiple Stored XSS in the language editor functionality (languages). A malicious attacker with admin privileges can inject arbitrary HTML and JS into the website, which will be rendered/executed on every page. By default, an admin user is not able to add JavaScript into the website.
- CVE-2025-9981Medium
QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.
- CVE-2025-9980Medium
QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.
Original NVD description (English source)
A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS