CVE-2025-54540

MEDIUM

QuickCMS - Reflected Cross-Site Scripting via sSort Parameter

Title source: llm

Description

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory

https://cert.pl/posts/2025/08/CVE-2025-54540

Product product

https://opensolution.org

Scores

CVSS v3 6.1

EPSS 0.0024

EPSS Percentile 14.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

opensolution/quick.cms 6.8

Published Aug 28, 2025

Tracked Since Feb 18, 2026