CVE-2025-50233

QCMS version 6.0.5 is vulnerable to a directory traversal flaw due to insufficient validation of the "Name" parameter in the backend template editor. Authenticated users can manipulate this parameter to read arbitrary files from the server outside the intended template directory. This could resul...

CVE-2018-8069

QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI...

CVE-2018-8070

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

SUSE CVE-2015-0811

The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service out-of-bounds read via an image that is improperly handled during transformation...

SUSE CVE-2015-4504

The lutinverseinterp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service buffer over-read and application crash via crafted attributes in the ICC 4 profile of an image...

SUSE CVE-2018-12366

An invalid grid size during QCMS color profile transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox ESR 52.9, and Firefox 61...

Mozilla Firefox Security Advisory (MFSA2015-98) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

qcms:fuzz: Heap-buffer-overflow in qcms::chain::qcms_modular_transform_create_lut::h1a73851109fbc700

Detailed Report: https://oss-fuzz.com/testcase?key=5081913385287680 Project: qcms Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasanqcms Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x6020000000b8 Crash State:...

QCMS suffers from a file upload vulnerability (CNVD-2020-27240)

QCMS website management system is a PHP lightweight system developed through MVC architecture. QCMS has a file upload vulnerability that can be exploited by an attacker to upload files arbitrarily and gain control of the server...

CVE-2020-10578

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

Arbitrary file deletion

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

CVE-2020-10578

CVE-2020-10578 affects QCMS v3.0.1 with an arbitrary file read vulnerability in the file path system/controller/backend/template.php. Multiple connected sources (NVD, Red Hat, CNVD, CNVD CNVD-2020-19603, etc.) corroborate that an attacker can read files, leading to information disclosure. The des...

CVE-2020-10578

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

CVE-2020-10578: Undefined Security Weakness

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to an unacceptable grid size during QCMS transformations. This allows attackers to disclose protected information.

The vulnerability of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, is related to an unacceptable grid size during QCMS transformations. Exploiting this vulnerability allows a malicious actor to disclose sensitive information obtained by reading beyond the buffer limit...

Stored Cross-Site Scripting Vulnerability in QCMS Website Management System Before and After

QCMS website management system is a PHP lightweight system developed through MVC architecture. A stored cross-site scripting vulnerability exists before and after the QCMS website management system. An attacker can insert malicious js code into a page to obtain user cookies and other information,...

Stored XSS Vulnerability in QCMS Website Management System

QCMS is a free, open source, easy to use, responsive website management system. A stored XSS vulnerability exists in the QCMS website management system, which can be exploited to obtain administrator account information...

SQL Injection Vulnerability in QCMS Backend

QCMS website management system is a PHP lightweight system developed through MVC architecture. There is a SQL injection vulnerability in the backend of QCMS, which can be exploited by attackers to obtain sensitive database information...

Denial Of Service (DoS)

Thunderbird, Firefox ESR and Firefox are vulnerable to denial of service attacks. A remote unauthenticated attacker could cause out-of-bounds memory read error during QCMS color profile transformations via QCMS Color Profile Transformation component...

Command Execution Vulnerability in QCMS

QCMS website management system is a PHP lightweight system developed through MVC architecture. QCMS has a command execution vulnerability that can be exploited by attackers to gain server privileges...