Loading story…
CERT Polska disclosed three vulnerabilities in OpenSolution Quick.CMS affecting versions through 6.8.0, warning that all versions should be treated as vulnerable even though testing was performed only on version 6.8. The issues were assigned CVE-2026-63301, CVE-2026-63302, and CVE-2026-63303. They include a client-side-only restriction bypass that allows an authenticated administrator to delete the primary language and trigger a denial of service, a local file inclusion flaw in admin.php via the p parameter, and a path traversal issue in URI handling that can expose files from a sibling directory of the webroot.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
OpenSolution assessed exploitation likelihood for all three disclosed Quick.CMS vulnerabilities as very low and decided fixes were not necessary. This vendor response was reported as part of the coordinated disclosure.
CERT Polska coordinated disclosure of three vulnerabilities affecting OpenSolution Quick.CMS versions through 6.8.0: CVE-2026-63301, CVE-2026-63302, and CVE-2026-63303. The disclosure noted only version 6.8 was tested, but all versions should be considered vulnerable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecert.pl
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed **CVE-2026-41874** in OpenSolution Quick.Cart, a flaw that stores hard-coded administrator credentials in plaintext within a configuration file. The issue is classified as **`CWE-256` Plaintext Storage of a Password** and affects Quick.Cart through version **6.7**; although only version 6.7 was explicitly tested, all versions are considered vulnerable. An attacker with access to the server file system could recover the embedded credentials and use them to escalate privileges within the application. CERT Polska said it received the report and coordinated disclosure, while the vendor assessed the likelihood of exploitation as very low and decided not to issue a fix.
Jul 28, 2026
CERT Polska disclosed four vulnerabilities in the Bludit content management system, including an unrestricted file upload flaw tracked as **CVE-2026-25099** that can lead to remote code execution, a stored XSS issue in image upload handling (**CVE-2026-25100**), a session fixation weakness that can enable session hijacking (**CVE-2026-25101**), and a separate stored XSS flaw in page creation tracked as **CVE-2026-4420**. The vulnerabilities were reported by researchers Arkadiusz Marta and Yassin Abdelrazek and affect multiple Bludit versions, with **CVE-2026-25099** impacting all releases before `3.18.4`, **CVE-2026-25101** affecting versions before `3.17.2`, **CVE-2026-25100** affecting all versions through `3.18.2`, and **CVE-2026-4420** confirmed in `3.17.2` and `3.18.0`. The XSS flaws can be exploited by authenticated users with content or page creation privileges by injecting malicious JavaScript into uploaded SVG content or article tags, with payloads executing when victims access publicly reachable resources without authentication. CERT Polska said the page-creation XSS could be used to automatically create a new site administrator if the victim has sufficient privileges, while the file upload issue could allow direct server-side compromise through remote code execution. The agency also said vendor coordination was incomplete, noting the vendor stopped responding or did not provide details on remediation and affected version ranges, raising uncertainty over whether some future releases may remain vulnerable.
Jun 29, 2026
CERT Polska disclosed three vulnerabilities in **JCD Windu CMS** affecting confirmed version **4.1**, warning that other versions may also be impacted. The issues include **CVE-2026-57309**, a blind SQL injection mapped to **`CWE-89`** that can be exploited remotely without authentication by injecting SQL syntax into a URL path carried in an HTTP header, and **CVE-2026-57310**, a password storage weakness mapped to **`CWE-916`** caused by the use of **MD5** and **SHA1** with a static salt. The advisory also details **CVE-2026-57311**, an unrestricted file upload flaw that allows an authenticated attacker to upload arbitrary files, including **PHP**, resulting in remote code execution. CERT Polska said it coordinated disclosure of the vulnerabilities and credited **Jakub Lipiński, Marek Tołczyk, and Kamil Królikowski** with the responsible report, underscoring the risk of database compromise, credential exposure, and server takeover in affected Windu CMS deployments.
Jul 20, 2026