Medium severity · published Aug 28, 2025
CVE-2025-54541
QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality
4.3
CVSS
0.1%
EPSS
No
On KEV
Description
QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quick.cms · Opensolution
6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54541
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54541
Third Party Advisory
https://cert.pl/posts/2025/08/CVE-2025-54540
Product
https://opensolution.org
More from Quick.cms
9.8
CVE-2024-58308
Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login
8.6
CVE-2023-43345
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in…
7.5
CVE-2026-11860
Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
7.5
CVE-2025-9982
Hard-coded admin credentials in Quick.CMS
7.2
CVE-2020-35754
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the…