Q-cms Qcms — known CVE vulnerabilities

Every CVE whose affected-product data names Q-cms Qcms, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (12)

• CVE-2018-14978 — CVSS 8.8 (high): An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI.
• CVE-2020-10578 — CVSS 7.5 (high): An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1.
• CVE-2025-50233 — CVSS 6.5 (medium): A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of…
• CVE-2018-14977 — CVSS 6.1 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different…
• CVE-2018-14973 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS.
• CVE-2018-14974 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS.
• CVE-2018-14969 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS.
• CVE-2018-14976 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS.
• CVE-2018-14975 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS.
• CVE-2018-14970 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS.
• CVE-2018-14971 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS.
• CVE-2018-14972 — CVSS 4.8 (medium): An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS.