GCVE - cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Qcubed (`1905121a-5ee5-5cfb-8800-d79932f20547`)
Product	Qcubed (`0e890a3d-f9c1-55cf-9564-df1814f2b5e5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/qcubed/qcubed`	purl2cpe	2026-06-01 10:12:51.818565

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-20288`	vulnerable	2026-11-03 10:02:55.167579	QCubed 3.1.1 Reflected XSS via installer step_2.php MEDIUM (6.1) QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20. Published: 2026-10-22T10:57:23.289Z Updated: 2026-10-29T11:04:55.766Z Open on db.gcve.eu Reference links https://github.com/qcubed/qcubed/issues/1230 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/qcubed-xss.yaml https://www.vulncheck.com/advisories/qcubed-3.1.1-reflected-xss-via-installer-step-2-php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-24914`	vulnerable	2026-06-08 05:22:35.722522	Details available A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request. Published: 2021-03-04T12:33:26.000Z Updated: 2026-07-09T00:11:05.755Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-01 https://tech.feedyourhead.at/content/QCubed-PHP-Object-Injection-CVE-2020-24914 http://seclists.org/fulldisclosure/2021/Mar/28 http://packetstormsecurity.com/files/161758/QCubed-3.1.1-PHP-Object-Injection.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-24913`	vulnerable	2026-06-08 05:22:35.722013	Details available A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request. Published: 2021-03-04T12:31:47.000Z Updated: 2026-07-09T00:11:04.533Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-02 https://tech.feedyourhead.at/content/QCubed-SQL-Injection-CVE-2020-24913 http://seclists.org/fulldisclosure/2021/Mar/30 http://seclists.org/fulldisclosure/2021/Mar/29 http://packetstormsecurity.com/files/161759/QCubed-3.1.1-SQL-Injection.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-24912`	vulnerable	2026-06-08 05:22:35.721529	Details available A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. Published: 2021-03-04T12:30:24.000Z Updated: 2026-07-09T00:11:03.307Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 https://tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912 http://seclists.org/fulldisclosure/2021/Mar/30 http://packetstormsecurity.com/files/161763/QCubed-3.1.1-Cross-Site-Scripting.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Qcubed

Notes

PURL mappings

Vulnerability references

Contribute