CVE-2026-41874
Received Received - Intake

Hard-Coded Admin Credentials in Quick.Cart

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: CERT.PL

Description
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary. Only version 6.7 was tested but all versions should be considered as vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-41874
EUVD
EUVD-2026-49766

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opensolution quick.cart to 6.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-256 The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. Attackers with server file system access can retrieve these credentials, potentially gaining admin privileges.

Detection Guidance

Check the configuration file of Quick.Cart for hard-coded admin credentials. Look for plaintext or weakly encoded passwords in files like config.php or similar configuration files. Search for strings like 'admin', 'password', or 'credential' in the file system where Quick.Cart is installed.

Impact Analysis

If an attacker gains file system access, they could use the exposed admin credentials to log in, modify store settings, access customer data, or perform unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive customer data, violating GDPR (data protection) and HIPAA (health data privacy) requirements, potentially resulting in legal penalties.

Mitigation Strategies

Since the vendor does not plan to fix this issue, consider migrating to a different shopping cart solution. If migration is not possible, restrict file system access to the Quick.Cart installation directory to prevent unauthorized access to configuration files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41874. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart