CVE-2026-41875
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable.
Risk Assessment
May allow an attacker to take over the admin account, leading to full compromise of the application and data.
Recommendation
Apply the patch to version 6.7 published on 09.11.2026 or later.
Other vulnerabilities in Quick.Cart
See all- CVE-2026-41874Medium
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. Attackers with server file system access can retrieve them, potentially leading to privilege escalation. The vendor assessed risk as very low and will not fix. Version 6.7 tested, but all versions are vulnerable.
- CVE-2025-10317Medium
Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. A malicious attacker can craft a special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker. The software does not implement any protection against this type of attack, and all forms are potentially vulnerable. Only version 6.7 was tested and confirmed as vulnerable.
Original NVD description (English source)
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable
Vulnerability data from NVD (NIST) · CISA KEV · EPSS