OpenSolution QuickCMS stored XSS flaws require admin access
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Stored XSS vulnerabilities in QuickCMS page and slider editors allow authenticated admins to inject malicious JavaScript.
CERT Polska disclosed two stored XSS vulnerabilities in OpenSolution QuickCMS affecting the page editor and slider editor functionality. Both CVE-2025-9980 and CVE-2025-9981 allow attackers with administrative privileges to inject arbitrary HTML and JavaScript that will be executed when pages are visited or rendered site-wide. The injected code persists in the application's storage, making it a stored rather than reflected attack. Version 6.8 has been confirmed vulnerable; other versions remain untested by the reporter. The vendor was notified early but did not provide details on the vulnerability scope or affected version range. No evidence of in-the-wild exploitation is mentioned. Defenders should treat this as a privilege-escalation and website-defacement risk requiring mitigation of admin account compromise and review of admin activity logs.
Mentioned in this report
Detection guidance
XSS Payload Markers in Requests to CMS admin.php Endpoint
Detects script-injection markers (script tags, event handlers, javascript: URIs) in the query string of requests to an admin.php back-end endpoint, as used by QuickCMS-style admin editors. Relevant to stored XSS such as CVE-2025-9980 and CVE-2025-9981. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: XSS Payload Markers in Requests to CMS admin.php Endpoint
description: 'Detects script-injection markers (script tags, inline event handlers,
javascript: URIs) in the query string of requests to an admin.php back-end endpoint.
Relevant to stored XSS in CMS page/slider editors such as OpenSolution QuickCMS
(CVE-2025-9980, CVE-2025-9981). Limitation: payloads sent in POST bodies are not
visible in standard web server logs, so this only catches GET or query-string delivery.
Pair with admin activity log review.'
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.007
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|endswith: /admin.php
selection_payload:
cs-uri-query|contains:
- <script
- '%3Cscript'
- '%3cscript'
- onerror=
- onload=
- 'javascript:'
- <iframe
- '%3Ciframe'
condition: selection_endpoint and selection_payload
falsepositives:
- Authorised web application security scans or penetration tests against the CMS admin
panel
- Administrators pasting embed markup into editor fields that is submitted via query
string
level: medium
id: caa5b03a-6b6c-5c80-8d6b-f9fc299366fc
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-9980
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-9980
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs