CVE-2017-20288

QCubed versions 2.2.0 through 3.1.1 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The issue exists because the installation_path parameter in the /assets/php/_devtools/installer/step_2.php endpoint is echoed without proper escaping. This allows unauthenticated attackers ...

EUVD-2017-19025

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...

Qcubed - Cross-Site Scripting Detection

Qcubed contains a cross-site scripting vulnerability which allows a remote attacker to inject arbitrary JavaScript via the /assets/php/devtools/installer/step2.php endpoint and the installationpath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Qcubed contains a cross-site scripting...

CVE-2011-3779

PhpHostBot 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/createacct.php and certain other files...

CVE-2011-3749

ka-Map 1.0-20070205 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by test.php and certain other files...