PT-2026-3928 · Unknown · Quick.Cart

Arkadiusz Marta · Published 2026-01-22 · Updated 2026-02-19 · CVE-2025-67683

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quick.Cart version 6.7

Description Quick.Cart is susceptible to a reflected cross-site scripting (XSS) issue through the sSort parameter. An attacker can create a malicious URL that, when accessed, leads to the execution of arbitrary JavaScript code within the victim's browser. The vendor was informed of this issue but did not provide details regarding vulnerable versions. The API endpoint potentially affected is not specified. The vulnerable parameter is sSort.

Recommendations Apply a fix for Quick.Cart version 6.7.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-67683

Affected Products

Quick.Cart

References · 13

• https://osv.dev/vulnerability/CVE-2025-67683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67683 · Security Note
• https://cert.pl/posts/2026/01/CVE-2025-67683 · Note
• https://t.me/cveNotify/149528 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014420131598786982 · Twitter Post
• https://twitter.com/CVEnew/status/2014316514762190850 · Twitter Post
• https://twitter.com/lsof/status/2014399441180987736 · Twitter Post
• https://t.me/cveNotify/152490 · Telegram Post
• https://twitter.com/lsof/status/2014399588019364180 · Twitter Post
• https://t.me/cveNotify/149527 · Telegram Post
• https://t.me/CVEtracker/42774 · Telegram Post
• https://t.me/cveNotify/152489 · Telegram Post
• https://opensolution.org/sklep-internetowy-quick-cart.html · Note