Vulnerabilities

TI-2026-19162 CVE-2026-23796 · GHSA-rfjq-chwp-46m7

Session Fixation in Quick.Cart

LOW 22

Quick.Cart allows a user's session identifier to be set before authentication.

CVSS 4.0MEDIUM 4.8 Local No auth User interaction EPSS 0.00307 Published 2026-02-05 No fix listed CWE-384

TI-2026-19163 CVE-2026-23797 · GHSA-jf4c-6xg3-hjc6

Plaintext password display in Quick.Cart

LOW 36

In Quick.Cart user passwords are stored in plaintext form.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00291 Published 2026-02-05 No fix listed CWE-256

TI-2025-41398 CVE-2025-67684 · GHSA-jchx-26cr-w8w2

Remote Code Execution via Local File Inclusion in Quick.Cart

MEDIUM 44

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.0082 Published 2026-01-22 No fix listed CWE-22

TI-2025-41397 CVE-2025-67683 · GHSA-x95g-m33x-ggjj

Reflected XSS in Quick.Cart

LOW 23

Quick.Cart is vulnerable to reflected XSS via the sSort parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00282 Published 2026-01-22 No fix listed CWE-79

TI-2020-18205 CVE-2020-35754 · GHSA-4wj8-83xp-85h6

OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform…

MEDIUM 45

OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.10898 Published 2021-01-28 No fix listed CWE-94

TI-2012-05177 CVE-2012-6430 · GHSA-gr7v-c884-98wj

Cross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart…

LOW 27

Cross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATH_INF…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0391 Published 2014-03-24 No fix listed CWE-79

TI-2012-05013 CVE-2012-6049 · GHSA-3hfj-pw8w-wj22

Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via…

LOW 26

Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invalid characters in a cookie, which reveals the installation path in an error message.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01354 Published 2012-11-27 No fix listed CWE-200

TI-2009-03909 CVE-2009-4120 · GHSA-gpv6-q6p5-p2g2

Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote…

LOW 32

Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete orders via an orders-delete action to adm…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00999 Published 2009-12-01 No fix listed CWE-352

TI-2008-03971 CVE-2008-4140 · GHSA-vxjx-mvpm-4657

Cross-site scripting (XSS) vulnerability in admin.php in Quick.Cart 3.1 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in admin.php in Quick.Cart 3.1 allows remote attackers to inject arbitrary web script or HTML via the query string.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01465 Published 2008-09-19 No fix listed CWE-79

Vulnerabilities

Filters