Reflected XSS Vulnerability in QuickCMS Admin Panel by Opensolution
CVE-2025-54540

5.1MEDIUM

Key Information:

Vendor

Opensolution

Status
Quickcms
Vendor
CVE Published:
28 August 2025

What is CVE-2025-54540?

QuickCMS contains a reflected cross-site scripting (XSS) vulnerability within its admin panel, particularly through the 'sSort' parameter. This allows attackers to craft a malicious URL that, when accessed by a user, executes arbitrary JavaScript in the victim's browser. Although version 6.8 has been confirmed as vulnerable, it remains unclear whether other versions are also at risk, as the vendor has not disclosed details regarding untested versions.

Affected Version(s)

QuickCMS 6.8

References

https://cert.pl/posts/2025/08/CVE-2025-54540
third-party-advisory
https://opensolution.org
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karol Czubernat
.
CVE-2025-54540 : Reflected XSS Vulnerability in QuickCMS Admin Panel by Opensolution