Quick.Cart CVE-2026-41874

Q: What is the CVSS score of CVE-2026-41874?

CVE-2026-41874 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-49766 MEDIUM

Plaintext Storage of a Password (CWE-256)

2026-07-28 CERT-PL

GHSA-5v73-8v9g-j67x

Privilege Escalation Quick Cart

6.8

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local access required, low complexity, attacker needs system-level privilege (PR:L), no user interaction.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 12:51 vuln.today

DescriptionCVE.org

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation.

The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

Only version 6.7 was tested but all versions should be considered as vulnerable.

AnalysisAI

Privilege escalation in Quick.Cart via hard-coded, plaintext admin credentials stored in a configuration file allows local attackers with file system access to retrieve authentication details and gain administrative control. The vendor considers exploitation unlikely and has not released a fix; all versions are believed vulnerable, with version 6.7 confirmed. No public exploit or active exploitation has been reported.

Technical ContextAI

The vulnerability is rooted in CWE-256 (Plaintext Storage of a Password), where the application stores administrator credentials in a configuration file without encryption. The CPE cpe:2.3:a:opensolution:quick.cart:*:*:*:*:*:*:* indicates all versions of the Quick.Cart shopping cart are affected. This design flaw exposes credentials to any local user who can read the file system, violating the principle of secure credential storage.

RemediationAI

No vendor-released patch exists; the vendor deemed a fix unnecessary. Compensating controls include: restricting file-system permissions on the configuration file (e.g., chmod 600 and owned by the web server user) to prevent unauthorized reads; implementing file integrity monitoring (e.g., auditd) to detect access; rotating admin credentials regularly and storing them in environment variables or a secrets manager (e.g., HashiCorp Vault) instead of plaintext files. These measures add administrative overhead but mitigate the exposure.