Opensolution - vulnerabilities (CVEs)
47 CVEs in 8 products, 1 in the last 30 days, newest from 2026-09-29.
Products
- Quick.cms - 18 CVEs
- Quickcms - 13 CVEs
- Quick.cart - 11 CVEs
- Quick Cms - 7 CVEs
- Quick.cms.lite - 4 CVEs
- Quick.cms.ext - 3 CVEs
- Quick.car - 1 CVEs
- Quick Cart - 0 CVEs
Newest CVEs of Opensolution
- CVE-2026-41875 - CVSS 6.9 (medium), 2026-09-29: Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin,…
- CVE-2026-33385 - CVSS 5.1 (medium), 2026-07-29: A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields…
- CVE-2026-41874 - CVSS 6.8 (medium), 2026-07-28: Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to…
- CVE-2026-63303 - CVSS 5.1 (medium), 2026-07-28: A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../)…
- CVE-2026-63302 - CVSS 5.1 (medium), 2026-07-28: Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can…
- CVE-2026-63301 - CVSS 7 (high), 2026-07-28: In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however,…
- CVE-2026-11860 - CVSS 7.5 (high), 2026-06-15: Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with…
- CVE-2026-33386 - CVSS 2.3 (low), 2026-05-29: QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can perform a…
- CVE-2026-33384 - CVSS 4.8 (medium), 2026-05-29: QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour…
- CVE-2021-47981 - CVSS 5.4 (medium), 2026-05-16: Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting…
- CVE-2026-1468 - CVSS 5.1 (medium), 2026-03-06: QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will…
- CVE-2026-23797 - CVSS 6.9 (medium), 2026-02-05: In Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page. The vendor was…
- CVE-2026-23796 - CVSS 9.8 (critical), 2026-02-05: Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This…
- CVE-2025-67683 - CVSS 6.1 (medium), 2026-01-22: Quick.Cart is vulnerable to reflected XSS via the sSort parameter. An attacker can craft a malicious URL which, when opened, results in arbitrary JavaScript…
- CVE-2025-67684 - CVSS 9.4 (critical), 2026-01-22: Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload…
- CVE-2024-58308 - CVSS 9.8 (critical), 2025-12-11: Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form.…
- CVE-2025-12465 - CVSS 8.6 (high), 2025-12-02: A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete…
- CVE-2025-9982 - CVSS 7.5 (high), 2025-11-14: A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw…
- CVE-2025-10018 - CVSS 4.8 (medium), 2025-11-14: QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can inject arbitrary HTML…
- CVE-2025-10317 - CVSS 5.1 (medium), 2025-10-30: Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. Malicious attacker can craft special website, which when visited by…
- CVE-2025-9980 - CVSS 4.8 (medium), 2025-10-23: QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML…
- CVE-2025-9981 - CVSS 4.8 (medium), 2025-10-23: QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary…
- CVE-2025-55175 - CVSS 6.1 (medium), 2025-08-28: QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that,…
- CVE-2025-54543 - CVSS 5.3 (medium), 2025-08-28: QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject…
- CVE-2025-54542 - CVSS 6.9 (medium), 2025-08-28: QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary…
- CVE-2025-54541 - CVSS 6.9 (medium), 2025-08-28: QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the…
- CVE-2025-54544 - CVSS 5.3 (medium), 2025-08-28: QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject…
- CVE-2025-54540 - CVSS 6.1 (medium), 2025-08-28: QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when…
- CVE-2025-54175 - CVSS 6.1 (medium), 2025-08-20: QuickCMS.EXT is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality. An attacker can craft a malicious URL that results in…
- CVE-2025-54174 - CVSS 5.1 (medium), 2025-08-20: QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which when visited by…
