CVE-2026-63301
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In Quick.CMS, the admin UI restricts deletion of the primary language, but the API endpoint lacks server-side authorization. An authenticated admin can send a direct HTTP request to delete the primary language, causing Denial of Service (DoS). Combined with a CSRF vulnerability (CVE-2026-1468), an unauthenticated attacker can trick an admin into clicking a malicious link, triggering DoS.
Risk Assessment
The attack can cause application unavailability (DoS), and combined with CSRF can be executed without direct attacker access to the system.
Recommendation
Implement server-side validation in the language deletion endpoint and protect against CSRF. The vendor assessed risk as low and will not fix, so manual hardening is recommended.
Other vulnerabilities in Quick.CMS
See all- CVE-2024-58308Critical
Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.
- CVE-2026-33385Medium
A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in the administration panel allows for Blind SQL Injection attacks. The vendor states that remediation was not deemed necessary due to the trust model.
- CVE-2026-63303Medium
Quick.CMS is vulnerable to Path Traversal via the URI path component of HTTP requests. An authenticated attacker with admin privileges can read files in the parent directory of the webroot using ../ sequences in the URI.
- CVE-2026-63302Medium
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files within the application's directory structure, revealing directory structure and absolute paths.
- CVE-2026-11860High
Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. Attackers can tamper with serialized payloads in transit and inject malicious objects, leading to remote code execution. Exploitation is triggered automatically when an administrator accesses the admin panel.
Original NVD description (English source)
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application. Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.