PT-2026-3928 · Unknown · Quick.Cart

Arkadiusz Marta · Publicado 2026-01-22 · Atualizado 2026-02-19 · CVE-2025-67683

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quick.Cart version 6.7

Description Quick.Cart is susceptible to a reflected cross-site scripting (XSS) issue through the sSort parameter. An attacker can create a malicious URL that, when accessed, leads to the execution of arbitrary JavaScript code within the victim's browser. The vendor was informed of this issue but did not provide details regarding vulnerable versions. The API endpoint potentially affected is not specified. The vulnerable parameter is sSort.

Recommendations Apply a fix for Quick.Cart version 6.7.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-67683

Produtos afetados

Quick.Cart

Referências · 13

• https://cert.pl/posts/2026/01/CVE-2025-67683 · Nota
• https://t.me/cveNotify/149528 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2014420131598786982 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014316514762190850 · Publicação no Twitter
• https://twitter.com/lsof/status/2014399441180987736 · Publicação no Twitter
• https://t.me/cveNotify/152490 · Publicação no Telegram
• https://twitter.com/lsof/status/2014399588019364180 · Publicação no Twitter
• https://t.me/cveNotify/149527 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-67683 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-67683 · Nota de Segurança
• https://t.me/CVEtracker/42774 · Publicação no Telegram
• https://t.me/cveNotify/152489 · Publicação no Telegram
• https://opensolution.org/sklep-internetowy-quick-cart.html · Nota