Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
QuickCMS allows attackers to trick users into making unintended changes
CVE-2026-1468
Summary
QuickCMS, a website platform, has a security flaw that lets hackers trick users into making changes to the site without their knowledge. This could allow an attacker to make changes that affect the site's security or user data. Until a fix is released, consider restricting user access to sensitive features and keeping a close eye on your site's activity.
Original title
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with ...
Original description
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.
This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
nvd CVSS4.0
5.1
Vulnerability type
CWE-352
Cross-Site Request Forgery (CSRF)
Published: 6 Mar 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026