Skip to content
OpenAdvisories

Package · Packagist

qcubed/qcubed

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.8
    CVE-2020-24914

    qcubed PHP object injection

    A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.

    qcubed/qcubed Packagist
  • Critical 9.8
    CVE-2020-24913 Public exploit EPSS 41%

    qcubed SQL injection vulnerability in profile.php via the strQuery parameter

    A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.

    qcubed/qcubed Packagist
  • Medium 6.1
    CVE-2020-24912 Scanner template

    qcubed reflected cross-site scripting (XSS) vulnerability

    A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.

    qcubed/qcubed Packagist