55 matches found
CVE-2020-24913-PoC
CVE-2020-24913-PoC A Poc for CVE-2020-24913, a SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request. This PoC is performed using a MyS...
CVE-2020-24913-exploit
qcubed-exploit You need Bun to be installed: https://bun.sh To install dependencies: bun install To run: show help bun run exploit -h test for vulnerability bun run exploit vulnerable -u https://site.com/framework/assets/core/php/profile.php create a session for a new target bun run exploit creat...
CVE-2017-20288
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
CVE-2017-20288
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
CVE-2017-20288
QCubed versions 2.2.0 through 3.1.1 are vulnerable to a reflected cross-site scripting (XSS) flaw. An unauthenticated attacker can inject malicious scripts by crafting GET requests to the /assets/php/_devtools/installer/step_2.php endpoint, specifically by providing malicious values in the instal...
EUVD-2017-19025
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
CVE-2017-20288
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
CVE-2017-20288 QCubed 3.1.1 Reflected XSS via installer step_2.php
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
PT-2026-121375
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation path parameter. Attackers can craft GET requests to /assets/php/ devtools/installer/step 2.php with malicious installation path value...
CVE-2017-20288: Improper Neutralization of Input During Web Page Generation
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
VulnCheck KEV: CVE-2017-20288
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
qcubed cross-site scripting vulnerability
Versions 2.2.0 through 3.1.1 of qcubed contain a cross-site scripting vulnerability. This flaw arises because the installationpath parameter is returned unsanitized or unescaped, potentially enabling reflected XSS attacks. Unauthenticated attackers can craft GET requests to...
QCube Cross-Site-Scripting Detection
A reflected cross-site scripting vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in...
Qcubed - Cross-Site Scripting Detection
Qcubed contains a cross-site scripting vulnerability which allows a remote attacker to inject arbitrary JavaScript via the /assets/php/devtools/installer/step2.php endpoint and the installationpath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Qcubed contains a cross-site scripting...
CVE-2020-24912
A reflected cross-site scripting XSS vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users...
CVE-2020-24914
A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...
VulnCheck KEV: CVE-2020-24914
A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...
GHSA-7W3C-JGH7-CWJW qcubed PHP object injection
A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...
qcubed PHP object injection
A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...
GHSA-8FJ6-PC5R-347Q qcubed SQL injection vulnerability in profile.php via the strQuery parameter
A SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request...