CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

CVE-2026-64829

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

CVE-2026-64829: Insufficient Session Expiration

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

EUVD-2017-4314

Malware in sbrugna...

CVE-2021-3258

Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...

CVE-2021-3258

Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...

PT-2021-19793

Name of the Vulnerable Software and Affected Versions Question2Answer Q2A Ultimate SEO version 1.3 Description The issue is related to cross-site scripting XSS, which may lead to arbitrary remote code execution. Recommendations For Question2Answer Q2A Ultimate SEO version 1.3, update to a version...

CVE-2021-3258: Improper Neutralization of Input During Web Page Generation

Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...

Question2Answer User Account Creation Vulnerability

Question2Answer is a PHP implementation of the class StackOverflow website question and answer system . A security vulnerability exists in the qa-include/qa-install.php file in Question2Answer versions prior to 1.7.5. A remote attacker can exploit this vulnerability to create multiple user accoun...

Code injection

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775

CVE-2017-12775 affects Question2Answer (qa-install.php) prior to version 1.7.5. The vulnerability allows remote attackers to create multiple user accounts, due to an issue in the installation script. Exploitation details are not explicitly provided beyond the description in the connected sources;...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

CVE-2017-12775: Improper Input Validation

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

Question2Answer 1.7 Cross Site Scripting

Title: Script Question2Answer 1.7 - Stored XSS Vulnerability + Author: s0w + Tested On Windows & Linux + Date: 21/03/2015 + Type: Web Application + Script Download: https://github.com/q2a/question2answer + Vendor Homepage: http://www.question2answer.org + Vulnerability...

Exploit for stealing admin's account in Question2Answer

Hello! Here is exploit for stealing admin's account in Question2Answer. This exploit uses Cross-Site Request Forgery vulnerability at http://site/account and Insufficient Anti-automation vulnerabilities at http://site/forgot and http://site/reset, which I've described in the second advisory about...

Question2Answer Cross Site Request Forgery

Hello! Here is exploit for stealing admin's account in Question2Answer. This exploit uses Cross-Site Request Forgery vulnerability at http://site/account and Insufficient Anti-automation vulnerabilities at http://site/forgot and http://site/reset, which I've described in the second advisory about...