Medium severity · published Aug 28, 2025
CVE-2025-54542
QuickCMS sends password and login via GET Request
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quick.cms · Opensolution
6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54542
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54542
Third Party Advisory
https://cert.pl/posts/2025/08/CVE-2025-54540
Product
https://opensolution.org
More from Quick.cms
9.8
CVE-2024-58308
Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login
8.6
CVE-2023-43345
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in…
7.5
CVE-2026-11860
Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
7.5
CVE-2025-9982
Hard-coded admin credentials in Quick.CMS
7.2
CVE-2020-35754
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the…