CVE-2020-35754

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 10%

from disclosure to weapon1 days

Published on NVDJan 28

1st PoC+1d

exploitation probability

10%top 5% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/49494unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html https://opensolution.org/cms-system-quick-cms.html https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/