# CVE-2026-33385: OpenSolution Quick.CMS Blind SQL injection in administration panel

Source: https://junglewise.ai/threats/cve-2026-33385-opensolution-quick-cms-blind-sql-injection-in-administration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-33385 · Severity: info · CVSS 5.1 · Published 2026-07-29

Quick.CMS is a content management system used to build and manage websites. A security flaw in the administration panel allows high-privileged users to perform unauthorized database operations. While this could lead to data corruption or the bypassing of certain interface restrictions, the vendor has declined to issue a fix, stating that administrative users already possess significant control over the system by design.

Technologies: [OpenSolution Quick.CMS](https://junglewise.ai/threats/technologies/quick-cms). Vendors: [OpenSolution](https://junglewise.ai/threats/vendors/opensolution).

## Quick answers

**Is CVE-2026-33385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33385 being exploited in the wild.

**How severe is CVE-2026-33385?** Informational severity, with a CVSS score of 5.1, published 29 July 2026.

**Which products and versions are affected?** OpenSolution Quick.CMS 6.8.

**Is there a fix for CVE-2026-33385?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33385 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-33385?** Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Blind SQL injection vulnerability exists in OpenSolution Quick.CMS version 6.8 due to improper neutralization of input within multiple fields of the administration panel. The flaw is reachable by a high-privileged authenticated user via the network. An attacker with administrative access can exploit this to bypass front-end validation controls or perform destructive operations on the underlying database. The vendor has acknowledged the report but stated that remediation is unnecessary because the administrative trust model already grants these users extensive modification capabilities. No patch is currently planned.

## Affected products

- OpenSolution Quick.CMS 6.8

## Timeline

- 2026-07-29: advisory: Advisory published by CERT.PL and NVD

## References

- [https://cert.pl/posts/2026/07/CVE-2026-33385/](https://cert.pl/posts/2026/07/CVE-2026-33385/)
- [https://opensolution.org/home.html](https://opensolution.org/home.html)

## Related threats

- [OpenSolution Quick.CMS path traversal in URI path](https://junglewise.ai/threats/cve-2026-63303-opensolution-quick-cms-path-traversal-in-uri-path)
- [OpenSolution Quick.CMS Local File Inclusion in admin.php](https://junglewise.ai/threats/cve-2026-63302-opensolution-quick-cms-local-file-inclusion-in-admin-php)
- [OpenSolution Quick.CMS Denial of Service via primary language deletion](https://junglewise.ai/threats/cve-2026-63301-opensolution-quick-cms-denial-of-service-via-primary-language)
- [OpenSolution Quick.CMS insecure deserialization in admin panel](https://junglewise.ai/threats/cve-2026-11860-opensolution-quick-cms-insecure-deserialization-in-admin-panel)
- [OpenSolution QuickCMS Cross-Site Scripting via insecure plugin fetching](https://junglewise.ai/threats/cve-2026-33386-opensolution-quickcms-cross-site-scripting-via-insecure-plugin)