CVE-2026-41875Medium· 6.9▾ TwilightPoC availableQuick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
1 GitHub repo
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable.
This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2019-13529High· 8.8An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior
CVE-2025-14117Medium· 4.3A vulnerability has been found in fit2cloud Halo 2.21.10
CVE-2015-20117Medium· 5.3RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation
CVE-2015-20113Medium· 5.3RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities
CVE-2024-0858High· 8.8The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
CVE-2025-15405Medium· 4.3A vulnerability was detected in PHPEMS up to 11.0