CVE-2020-35754

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-01-28 · updated 2026-06-17
Weakness: CWE-94

Description

OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.

Affected products

OpenSolution Quick.Cart: before 6.7 — fixed in 6.7
OpenSolution Quick.CMS: before 6.7 — fixed in 6.7

How to fix

Upgrade to a fixed version: OpenSolution Quick.Cart 6.7; OpenSolution Quick.CMS 6.7. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html
https://opensolution.org/cms-system-quick-cms.html
https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html
https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/
http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html
https://opensolution.org/cms-system-quick-cms.html
https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html
https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/

Get alerted when CVE-2020-35754 or the next vulnerability affects your stack