CVE-2026-1468mediumCWE-352

CVE-2026-1468: falha de média gravidade em OpenSolution QuickCMS

Cross-Site Request Forgery in QuickCMS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar QuickCMS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.2%
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
OpenSolution · QuickCMS
CVEs relacionadas — OpenSolution QuickCMS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-55175MEDIUMReflected XSS in QuickCMSEPSS 0.3%CVE-2025-54540MEDIUMReflected XSS in QuickCMSEPSS 0.3%CVE-2025-12465HIGHBlind SQL Injection in QuickCMSEPSS 0.3%CVE-2025-9982MEDIUMHard-coded admin credentials in Quick.CMSEPSS 0.3%CVE-2025-54544MEDIUMStored XSS in QuickCMSEPSS 0.2%CVE-2025-54543MEDIUMStored XSS in QuickCMSEPSS 0.2%