CVE-2026-23797 PUBLISHED

Plaintext password display in Quick.Cart

Assigner: CERT-PL
Reserved: 16.01.2026 Published: 05.02.2026 Updated: 05.02.2026

In Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	High
User Interaction	None

CVSS 4.0

Product Status

Vendor	OpenSolution
Product	Quick.Cart
Versions	Default: unknown Version 6.7 is affected

Credits

Beniamin Jabłoński finder

References

Problem Types

CWE-256 Plaintext Storage of a Password CWE

Impacts

CAPEC-21 Exploitation of Trusted Identifiers