OpenSolution vulnerabilities
We track 8 vulnerabilities in OpenSolution products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2026.
Latest OpenSolution vulnerabilities
- 7.0 High severity
Quick.CMS: Client-Side Enforcement of Server-Side Security
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization
- 7.5 High severity
Quick.CMS: Improper Control of Generation of Code
Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without
- 9.8 Critical severity
Quick.Cart: Session Fixation
Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The
- 7.2 High severity
Quick.Cart: Improper Limitation of a Pathname to a Restricted Directory
Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include
- 9.8 Critical severity
Quick.CMS: Improper Neutralization of Special Elements used in an SQL Command
Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to
- 8.6 High severity
QuickCMS: Improper Neutralization of Special Elements used in an SQL Command
A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn'
- 7.5 High severity
QuickCMS: Plaintext Storage of a Password
A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication detai
- 8.6 High severity
Quick CMS: Improper Neutralization of Input During Web Page Generation
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in the Pages Menu component.