qcubed reflected cross-site scripting (XSS) vulnerability

MITTEL 6.1CVE-2020-24912 · GHSA-xj4v-gp4q-h6qq · Published 04/03/2021 · updated 09/07/2026

Kurz gesagt

CVE-2020-24912 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in qcubed/qcubed, qcubed (qcubed).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 6.3%, höher als bei 93.6% aller Schwachstellen.
Abhilfe: auf 3.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
qcubed/qcubed Packagist	`< 3.2`	`3.2`
qcubed qcubed	`≤ 3.1.1`	No fix yet

Description

A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-24912 · ADVISORY
qcubed/qcubed#1320 · WEB
qcubed/qcubed · PACKAGE
tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912 · WEB
ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 · WEB
qcubed.com · WEB
seclists.org/fulldisclosure/2021/Mar/30 · WEB
packetstormsecurity.com/files/161763/QCubed-3.1.1-Cross-Site-Scripting.html

Weitere Schwachstellen in qcubed/qcubed

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

qcubed/qcubed

Packagist

< 3.2

3.2

qcubed

≤ 3.1.1

No fix yet

Description

NVD description

Weitere Schwachstellen in qcubed/qcubed

Alle anzeigen →