Skip to main content

Quick Cms CVE-2025-54542

MEDIUM
Use of GET Request Method With Sensitive Query Strings (CWE-598)
2025-08-28 cvd@cert.pl
Information Disclosure Quick Cms
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 19:09 vuln.today
CVE Published
Aug 28, 2025 - 11:15 nvd
MEDIUM 6.9

DescriptionCVE.org

QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

AnalysisAI

QuickCMS sends password and login via GET Request. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-598. QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Affected products include: Opensolution Quick.Cms. Version information: version 6.8.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Quick Cms

View all
CVE-2023-43345 HIGH POC
8.6 Oct 19

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co
CVE-2023-43346 MEDIUM POC
5.4 Oct 20

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co
CVE-2023-43344 MEDIUM POC
5.4 Oct 19

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co
CVE-2023-43342 MEDIUM POC
5.4 Oct 19

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co
CVE-2023-43343 MEDIUM POC
5.4 Oct 05

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary co
CVE-2012-3833 MEDIUM POC
4.3 Jul 03

Cross-site scripting (XSS) vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to
CVE-2026-11860 HIGH
7.5 Jun 15

Unsafe PHP deserialization in Quick.CMS by OpenSolution lets an on-path attacker who can tamper with the plaintext HTTP

CVE-2025-9982 MEDIUM
6.9 Nov 14

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file a
CVE-2025-10018 MEDIUM
4.8 Nov 14

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Rated medium severity (CVSS

CVE-2025-55175 MEDIUM
5.1 Aug 28

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. Rated medium severity (C
CVE-2025-54544 MEDIUM
5.3 Aug 28

QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Rated medium sev
CVE-2025-54543 MEDIUM
5.3 Aug 28

QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Rated medium sever

Same weakness CWE-598 – Use of GET Request Method With Sensitive Query Strings

View all
CVE-2023-6014 CRITICAL POC
9.8
CVE-2025-56551 HIGH POC
8.2
CVE-2026-23846 HIGH POC
8.1
CVE-2026-26721 HIGH POC
7.1
CVE-2017-3185 CRITICAL
9.8
CVE-2025-69270 CRITICAL
9.8
CVE-2018-14822 CRITICAL
9.8
CVE-2025-51651 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2025-54542 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy