CVE-2017-20288

QCubed versions 2.2.0 through 3.1.1 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The issue exists because the installation_path parameter in the /assets/php/_devtools/installer/step_2.php endpoint is echoed without proper escaping. This allows unauthenticated attackers ...

EUVD-2017-19025

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...

Qcubed - Cross-Site Scripting Detection

Qcubed contains a cross-site scripting vulnerability which allows a remote attacker to inject arbitrary JavaScript via the /assets/php/devtools/installer/step2.php endpoint and the installationpath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Qcubed contains a cross-site scripting...