Loading story…
CERT Polska disclosed CVE-2026-41875, a cross-site request forgery (CSRF) vulnerability affecting OpenSolution Quick.Cart through version 6.7.0. An attacker can induce an authenticated Quick.Cart administrator to visit a malicious website, which submits a forged POST request to the administrative configuration panel and changes the administrator login and password, enabling account takeover.
Quick.Cart’s existing CSRF control can reportedly be bypassed through manipulation of the Referer header, potentially leaving other application forms exposed to forged requests. CERT Polska coordinated disclosure following a report from Karol Czubernat; organizations should apply the patch for version 6.7 released on 9 November 2026 and verify that state-changing requests use robust anti-CSRF tokens rather than relying on Referer validation.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Karol Czubernat reported CVE-2026-41875, a CSRF flaw affecting OpenSolution Quick.Cart through version 6.7.0, and CERT Polska participated in coordinated disclosure. The flaw can let a crafted site trigger an authenticated administrator to change administrator credentials by bypassing the product's Referer-based CSRF protection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed **CVE-2026-41874** in OpenSolution Quick.Cart, a flaw that stores hard-coded administrator credentials in plaintext within a configuration file. The issue is classified as **`CWE-256` Plaintext Storage of a Password** and affects Quick.Cart through version **6.7**; although only version 6.7 was explicitly tested, all versions are considered vulnerable. An attacker with access to the server file system could recover the embedded credentials and use them to escalate privileges within the application. CERT Polska said it received the report and coordinated disclosure, while the vendor assessed the likelihood of exploitation as very low and decided not to issue a fix.
Jul 28, 2026
CERT Polska disclosed three vulnerabilities in OpenSolution **Quick.CMS** affecting versions through **6.8.0**, warning that all versions should be treated as vulnerable even though testing was performed only on version 6.8. The issues were assigned **`CVE-2026-63301`**, **`CVE-2026-63302`**, and **`CVE-2026-63303`**. They include a client-side-only restriction bypass that allows an authenticated administrator to delete the primary language and trigger a denial of service, a local file inclusion flaw in `admin.php` via the `p` parameter, and a path traversal issue in URI handling that can expose files from a sibling directory of the webroot.
Jul 28, 2026
A critical missing-authentication vulnerability tracked as **`CVE-2026-41452`** affects **Krayin CRM 2.2.4** and allows remote, unauthenticated attackers to seize the primary administrator account. The flaw resides in the product's installer middleware, where a crafted HTTP `POST` request using the `X-Requested-With: XMLHttpRequest` header can bypass the `CanInstall` middleware redirect check and reach the `install/api/admin-config-setup` endpoint. Researchers said the vulnerable endpoint performs an unauthenticated `updateOrInsert` against a hardcoded administrator user ID, letting an attacker set arbitrary administrator name, email, and password values and gain full access to CRM data. The issue has been rated **Critical**, with reported scores of **CVSS 3.1 9.8** and **CVSS 4.0 9.3**; recommended mitigations include updating Krayin CRM, applying vendor patches, and removing or properly securing the installer after deployment.
Aug 3, 2026