QuickCMS vulnerabilities
3 known CVE vulnerabilities in QuickCMS, translated and rated.
- CVE-2026-33386Low
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin-fetching mechanism. An attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. The issue was fixed in a patch to version 6.8 published on 15.05.2026.
- CVE-2026-33384Medium
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.
- CVE-2026-1468Medium
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft a special website that, when visited by the victim, automatically sends a POST request with the victim's privileges. No protection is implemented. Fixed in version 6.8 (14.05.2026).