CVE-2026-41874

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary. Only version 6.7 was tested but all versions should be considered as vulnerable.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/07/CVE-2026-41874/
https://opensolution.org/shopping-cart-quick-cart.html

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Quick.Cart almacena credenciales de administrador codificadas de forma rígida y en texto plano en un archivo de configuración. Esta falla permite a atacantes con acceso al sistema de archivos del servidor recuperar detalles de autenticación, lo que podría conducir a una escalada de privilegios. El proveedor evaluó la probabilidad de explotación como muy baja y determinó que una solución no es necesaria. Solo se probó la versión 6.7, pero todas las versiones deben considerarse vulnerables.

Information

Published : 2026-07-28 13:18

Updated : 2026-10-24 13:10

NVD link : CVE-2026-41874

Mitre link : CVE-2026-41874

CVE.ORG link : CVE-2026-41874

JSON object : View

Products Affected

No product.

CWE

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2026-41874", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41874", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T19:19:25.059016Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "OpenSolution", "product": "Quick.Cart", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.7"}], "defaultStatus": "unknown"}]}], "published": "2026-07-28T13:18:23.180", "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-41874/", "source": "cvd@cert.pl"}, {"url": "https://opensolution.org/shopping-cart-quick-cart.html", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation.\n\n\nThe vendor assessed the likelihood of exploitation as very low and determined that a fix is\u00a0not necessary.\n\n\n\nOnly version 6.7 was tested but all versions should be considered as vulnerable."}, {"lang": "es", "value": "Quick.Cart almacena credenciales de administrador codificadas de forma r\u00edgida y en texto plano en un archivo de configuraci\u00f3n. Esta falla permite a atacantes con acceso al sistema de archivos del servidor recuperar detalles de autenticaci\u00f3n, lo que podr\u00eda conducir a una escalada de privilegios.\n\nEl proveedor evalu\u00f3 la probabilidad de explotaci\u00f3n como muy baja y determin\u00f3 que una soluci\u00f3n no es necesaria.\n\nSolo se prob\u00f3 la versi\u00f3n 6.7, pero todas las versiones deben considerarse vulnerables."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cvd@cert.pl"}