CVE-2025-54172

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54172
QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. Regular admin user is not able to inject any JS scripts into the page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cert.pl/en/posts/2025/08/CVE-2025-54172 Third Party Advisory
https://opensolution.org/cms-system-quick-cms.html Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:opensolution:quick.cms:6.8:*:*:*:*:*:*:*
History

08 Sep 2025, 17:10

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
First Time Opensolution
Opensolution quick.cms
References () https://cert.pl/en/posts/2025/08/CVE-2025-54172 - () https://cert.pl/en/posts/2025/08/CVE-2025-54172 - Third Party Advisory
References () https://opensolution.org/cms-system-quick-cms.html - () https://opensolution.org/cms-system-quick-cms.html - Product
CPE cpe:2.3:a:opensolution:quick.cms:6.8:*:*:*:*:*:*:*
Summary
  • (es) QuickCMS es vulnerable a XSS almacenado en el parámetro sTitle del editor de páginas. Un atacante malicioso con privilegios de administrador puede inyectar HTML y JS arbitrarios en el sitio web, que se renderizarán o ejecutarán al visitar la página editada. Un usuario administrador no puede inyectar ningún script JS en la página. El proveedor fue notificado con antelación sobre esta vulnerabilidad, pero no respondió con los detalles ni el rango de versiones vulnerables. Solo la versión 6.8 se probó y se confirmó como vulnerable; otras versiones no se probaron y también podrían ser vulnerables.

20 Aug 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-20 13:15

Updated : 2025-09-08 17:10

NVD link : CVE-2025-54172

Mitre link : CVE-2025-54172

CVE.ORG link : CVE-2025-54172

JSON object : View

Products Affected

opensolution

  • quick.cms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')