CVE-2025-54175 Details
Description
QuickCMS.EXT is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality. An attacker can craft a malicious URL that results in arbitrary JavaScript execution in the victim's browser when opened. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
A reflected cross-site scripting vulnerability has been identified in OpenSolution QuickCMS.EXT version 6.8. The issue arises in the thumbnail viewer functionality, where the 'sFileName' parameter can be exploited to execute arbitrary JavaScript in the victim's browser. Although the vendor was notified about this vulnerability, they did not provide details on the vulnerable version range. However, version 6.8 has been tested and confirmed as vulnerable, while other versions may also be affected.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/posts/2025/08/CVE-2025-54172 | [email protected] | Third Party Advisory |
| https://opensolution.org/professional-cms-system-quick-cms-ext.html | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opensolution quick.cms.ext | 6.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2025 | Initial Analysis | [email protected] |
| Aug 20, 2025 | New CVE Received | [email protected] |