CVE-2026-33385

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for significant modification capabilities. The SQL injection vulnerability primarily enables bypassing front-end validation controls and potential database destruction. Given the trust model in which this application is designed to be administered, remediation of this issue was not deemed necessary by the vendor. This vulnerability has been found in version 6.8, but other versions might also be vulnerable.

• CWE-89

• https://cert.pl/posts/2026/07/CVE-2026-33385/
• https://opensolution.org/home.html

Published

Jul 29, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33378Using the $__timeGroup macro, one can achieve an OOM by over…6.5
• CVE-2026-3338Improper signature validation in PKCS7_verify() in AWS-LC al…8.7
• CVE-2026-33380A vulnerability in SQL Expressions allows an authenticated a…6.5
• CVE-2026-33381When a user's access to mint tokens for a service account is…8.1
• CVE-2026-33382Several Grafana API endpoints, some of them unauthenticated,…7.5
• CVE-2026-33384QuickCMS allows a user's session identifier to be set before…4.8
• CVE-2026-33386QuickCMS is vulnerable to Cross-Site Scripting (XSS) through…2.3
• CVE-2026-3339The Keep Backup Daily plugin for WordPress is vulnerable to …2.7
• CVE-2026-33390An Incorrect Privilege Assignment vulnerability was discover…8.1
• CVE-2026-33392In JetBrains YouTrack before 2025.3.131383 high privileged u…7.2
• CVE-2026-33393Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33394Discourse is an open-source discussion platform. Prior to ve…2.7