CVE-2026-41874
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. Attackers with server file system access can retrieve them, potentially leading to privilege escalation. The vendor assessed risk as very low and will not fix. Version 6.7 tested, but all versions are vulnerable.
Risk Assessment
An attacker with file system access can compromise the admin account, gaining full control over the application and data.
Recommendation
Manually change the admin credentials in the configuration file and consider migrating to a more secure solution, as the vendor will not release a patch.
Other vulnerabilities in Quick.Cart
See all- CVE-2026-41875Medium
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable.
- CVE-2025-10317Medium
Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. A malicious attacker can craft a special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker. The software does not implement any protection against this type of attack, and all forms are potentially vulnerable. Only version 6.7 was tested and confirmed as vulnerable.
Original NVD description (English source)
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary. Only version 6.7 was tested but all versions should be considered as vulnerable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS