# OpenSolution QuickCMS stored XSS flaws require admin access

Published: 2025-10-23 · Severity: routine
Canonical: https://vorant.io/reports/510300a2-d862-5a80-8df1-01b6cd0ca082/opensolution-quickcms-stored-xss-flaws-require-admin-access

> Stored XSS vulnerabilities in QuickCMS page and slider editors allow authenticated admins to inject malicious JavaScript.

CERT Polska disclosed two stored XSS vulnerabilities in OpenSolution QuickCMS affecting the page editor and slider editor functionality. Both CVE-2025-9980 and CVE-2025-9981 allow attackers with administrative privileges to inject arbitrary HTML and JavaScript that will be executed when pages are visited or rendered site-wide. The injected code persists in the application's storage, making it a stored rather than reflected attack. Version 6.8 has been confirmed vulnerable; other versions remain untested by the reporter. The vendor was notified early but did not provide details on the vulnerability scope or affected version range. No evidence of in-the-wild exploitation is mentioned. Defenders should treat this as a privilege-escalation and website-defacement risk requiring mitigation of admin account compromise and review of admin activity logs.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9980, CVE-2025-9981

## Detection guidance (public sample)

### XSS Payload Markers in Requests to CMS admin.php Endpoint

ATT&CK: T1190

Detects script-injection markers (script tags, event handlers, javascript: URIs) in the query string of requests to an admin.php back-end endpoint, as used by QuickCMS-style admin editors. Relevant to stored XSS such as CVE-2025-9980 and CVE-2025-9981. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: XSS Payload Markers in Requests to CMS admin.php Endpoint
description: 'Detects script-injection markers (script tags, inline event handlers,
  javascript: URIs) in the query string of requests to an admin.php back-end endpoint.
  Relevant to stored XSS in CMS page/slider editors such as OpenSolution QuickCMS
  (CVE-2025-9980, CVE-2025-9981). Limitation: payloads sent in POST bodies are not
  visible in standard web server logs, so this only catches GET or query-string delivery.
  Pair with admin activity log review.'
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.007
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: /admin.php
  selection_payload:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - '%3cscript'
    - onerror=
    - onload=
    - 'javascript:'
    - <iframe
    - '%3Ciframe'
  condition: selection_endpoint and selection_payload
falsepositives:
- Authorised web application security scans or penetration tests against the CMS admin
  panel
- Administrators pasting embed markup into editor fields that is submitted via query
  string
level: medium
id: caa5b03a-6b6c-5c80-8d6b-f9fc299366fc
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-9980
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-9980

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/510300a2-d862-5a80-8df1-01b6cd0ca082/opensolution-quickcms-stored-xss-flaws-require-admin-access.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup