Quick.CMS 6.7 contains a cross‑site scripting flaw in the sliders form that occurs when an attacker, who is already authenticated as an administrator, submits malicious content through the sDescription field. The flaw allows arbitrary JavaScript to execute in the victim’s browser at the moment the form is submitted. This client‑side execution can affect the user's session and data while interacting with the page.

The vulnerability is limited to OpenSolution’s Quick.CMS application, specifically version 6.7. CPE entries also list version 6.8, but the description references only 6.7, so installations of Quick.CMS 6.7 are confirmed to be affected.

The CVSS score of 5.1 places the issue in the medium‑severity range. EPSS is not available, indicating an unknown exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as an administrator and to deliver the payload via a CSRF form targeting the admin.php?p=sliders-form endpoint. The attack vector is therefore CSRF from a trusted session.