CVE-2025-63748

QaTraq version 6.9.2 is vulnerable to an unrestricted file upload flaw within the "Test Script" module. The "Add Attachment" feature fails to enforce file type restrictions, allowing authenticated users to upload executable PHP files . An attacker can subsequently access these files via the "View...

PT-2025-47158

Name of the Vulnerable Software and Affected Versions QaTraq version 6.9.2 Description QaTraq version 6.9.2 allows authenticated users to upload arbitrary files through the “Add Attachment” feature within the “Test Script” module. The application does not restrict file types, allowing the upload ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by supplying crafted Vega JSON definitions that abuse expression...