CVE-2024-58308

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Dec 11, 2025

CISA due date

—

The record

Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.

Affected packages

Ecosystem	Package	Introduced	Fixed