Plaintext Password Storage in Quick.Cart by OpenSolution
CVE-2026-23797

6.9MEDIUM

Key Information:

Vendor

Opensolution

Status
Quick.cart
Vendor
CVE Published:
5 February 2026

What is CVE-2026-23797?

In Quick.Cart, user passwords are stored in plaintext, which poses a significant security risk. Attackers with elevated privileges can access and display these passwords via the user editing page. This issue was identified in version 6.7, which has been confirmed to be vulnerable. Other versions may also be at risk, but they have not been tested or disclosed by the vendor concerning specifics of the vulnerability.

Affected Version(s)

Quick.Cart 6.7

References

https://opensolution.org/sklep-internetowy-quick-cart.html
product
https://cert.pl/posts/2026/02/CVE-2026-23796
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Beniamin Jabłoński
.