Quick.Cms CVE-2025-9981

Q: What is the CVSS score of CVE-2025-9981?

CVE-2025-9981 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-23 cvd@cert.pl

XSS Quick Cms

4.8

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Admin-only injection point forces PR:H; stored payload executes in a victim's browser requiring UI:R and crossing a security boundary (S:C) with low C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:42 vuln.today

DescriptionCVE.org

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

AnalysisAI

Stored cross-site scripting in the slider editor (sliders-form) of OpenSolution Quick.Cms lets an authenticated administrator inject arbitrary HTML and JavaScript that is persisted and rendered on every page of the site. The flaw is notable as a bypass of an intended restriction: by default admin users are not supposed to be able to add JavaScript to the website, so the slider editor provides a route around that control. Realistic risk is limited because exploitation requires a pre-existing admin account (PR:H) and a victim must subsequently load an affected page (UI:P); only version 6.8 has been tested and confirmed vulnerable, vulnerability applicability to other versions is unverified, EPSS is low at 0.19% (8th percentile), and no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Quick.Cms is a lightweight PHP/MySQL flat-file content management system distributed by OpenSolution. CVE-2025-9981 is a CWE-79 improper neutralization of input during web page generation (cross-site scripting) instance in the slider editor component, reachable via the sliders-form administrative interface. The root cause is that user-supplied HTML entered in the slider editor is stored server-side and later emitted into the page template without adequate output encoding or JavaScript sanitization. Because the stored payload is included in a template element rendered on every page, a single injection persists across the whole site rather than a single view. The intended security model explicitly blocks administrators from adding JavaScript to site content, so the slider editor represents an authorization/logic bypass of that restriction rather than a privilege-escalation from a low-privileged user. The affected CPE is cpe:2.3:a:opensolution:quick.cms:6.8, the only version tested and confirmed vulnerable; the vendor declined to provide a vulnerable version range, so the true scope is unknown. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, reflecting a scope-changing, low-impact integrity/confidentiality effect gated behind high privileges and victim interaction.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor was notified early but did not respond with vulnerability details or a fixed version, so upgrade guidance cannot be given and administrators should not assume any release is fixed. Affected Quick.Cms 6.8 installations should apply compensating controls: restrict or disable access to the slider editor (sliders-form) by requiring additional authentication/network allow-listing or by removing the editor from the admin menu for non-essential accounts, accepting that slider management must then be performed by a small trusted group. Because the entire impact depends on an attacker already holding admin credentials, prioritize credential hygiene - enforce unique strong passwords, rotate any shared admin accounts, and audit admin logins - as this removes the prerequisite (PR:H) rather than mitigating the XSS itself. Server-side output encoding/sanitization of slider content (escaping stored values when rendering, or stripping script and event-handler attributes before persistence) is an effective interim fix but requires code modification that will be overwritten by any future Quick.Cms update. Finally, monitor the CERT Polska advisory and the OpenSolution product page for a fixed release, and deploy a Content-Security-Policy without unsafe-inline to reduce stored-script execution, noting that CSP can break legitimate site functionality and is not a substitute for patching.