CVE-2026-63302: medium-severity vulnerability in OpenSolution Quick.CMS
Local File Inclusion in Quick.CMS
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.5%
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure).
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
OpenSolution · Quick.CMSRelated CVEs — OpenSolution Quick.CMS
In the same product, most dangerous first.
CVE-2026-63301HIGHDenial of Service in Quick.CMSEPSS 0.6%CVE-2026-63303MEDIUMPath Traversal in Quick.CMSEPSS 0.6%CVE-2026-33385MEDIUMBlind SQL Injection in Quick.CMSEPSS 0.4%CVE-2026-11860HIGHInsecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMSEPSS 0.2%CVE-2025-54172MEDIUMStored Cross-Site Scripting in QuickCMSEPSS 0.2%CVE-2025-54174MEDIUMCross-Site Request Forgery in QuickCMSEPSS 0.2%