qcms vulnerabilities

Products

• qcms 3

Latest qcms CVEs

Newest publication first

1. CVE-2026-94110 QCMS Content Detail Controllers.php self_Tmp sql injection

   Published 2026-09-21

   Medium·CVSS 6.9

   A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from r...

2. CVE-2018-8070 QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.

   Published 2018-03-12

   Medium·CVSS 5.4

   QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.

3. CVE-2018-8069 QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.

   Published 2018-03-12

   Medium·CVSS 5.4

   QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.