CVE-2025-54175

MEDIUM

QuickCMS.EXT - Reflected Cross-Site Scripting via sFileName Parameter in Thumbnail Viewer

Title source: llm

Description

QuickCMS.EXT is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality. An attacker can craft a malicious URL that results in arbitrary JavaScript execution in the victim's browser when opened. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory

https://cert.pl/posts/2025/08/CVE-2025-54172

Product product

https://opensolution.org/professional-cms-system-quick-cms-ext.html

Scores

CVSS v3 6.1

EPSS 0.0022

EPSS Percentile 11.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

opensolution/quick.cms.ext 6.8

Published Aug 20, 2025

Tracked Since Feb 18, 2026