CVE-2026-23797

MEDIUM

4.9

Descripcion

In Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Detalles CVE

Puntuacion CVSS v3.14.9

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosHIGH

Interaccion usuarioNONE

Publicado2/5/2026

Ultima modificacion2/19/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

opensolution:quick.cart

Debilidades (CWE)

CWE-256

Referencias

https://cert.pl/posts/2026/02/CVE-2026-23796(cvd@cert.pl)

https://opensolution.org/sklep-internetowy-quick-cart.html(cvd@cert.pl)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.