← Vulnerability feed

Vulnerability record · CVE-2020-35754 · published 28 January 2021

CVE-2020-35754: Opensolution quick.cart code injection vulnerability

Opensolution · Quick.Cart

OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.

7.2 CVSS 3.1 High EPSS 10% · top 4.4% CWE-94 · Code injection
7.2CVSS 3.1 base score, v2 6.5
10%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://opensolution.org/cms-system-quick-cms.html Product
https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html
https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/ ExploitThird Party Advisory
http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://opensolution.org/cms-system-quick-cms.html Product
https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html
https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/ ExploitThird Party Advisory

Track CVE-2020-35754 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2025-67684Opensolution quick.cart path traversal vulnerabilityQuick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to u…EPSS 0.83%6.9CVE-2026-23797Opensolution quick.cart vulnerabilityIn Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page. The ven…EPSS 0.26%6.9CVE-2025-9982Opensolution quick.cms vulnerabilityA vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This …EPSS 0.27%6.9CVE-2025-54541Opensolution quick.cms cross-site request forgery vulnerabilityQuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited…EPSS 0.15%6.9CVE-2025-54542Opensolution quick.cms vulnerabilityQuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary c…EPSS 0.14%6.8CVE-2009-4120Opensolution quick.cart cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator…EPSS 1.00%6.8CVE-2009-4121Opensolution quick.cms cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the authenticatio…EPSS 0.65%5.3CVE-2025-54543Opensolution quick.cms cross-site scripting vulnerabilityQuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can in…EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2020-35754), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.