CVE-2025-12465highCWE-89

CVE-2025-12465: high-severity vulnerability in OpenSolution QuickCMS

Blind SQL Injection in QuickCMS

Published

Follow this CVE+ Monitor QuickCMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.3%
A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
OpenSolution · QuickCMS
Related CVEs — OpenSolution QuickCMS

In the same product, most dangerous first.

CVE-2025-55175MEDIUMReflected XSS in QuickCMSEPSS 0.3%CVE-2025-54540MEDIUMReflected XSS in QuickCMSEPSS 0.3%CVE-2025-9982MEDIUMHard-coded admin credentials in Quick.CMSEPSS 0.3%CVE-2026-1468MEDIUMCross-Site Request Forgery in QuickCMSEPSS 0.2%CVE-2025-54544MEDIUMStored XSS in QuickCMSEPSS 0.2%CVE-2025-54543MEDIUMStored XSS in QuickCMSEPSS 0.2%