QCubed CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM QCubed CVE published 2026-10-22

CVE-2017-20288

A reflected cross-site scripting vulnerability exists in QCubed versions 2.2.0 through 3.1.1. Unauthenticated attackers can inject scripts through the installation_path parameter in GET requests to /assets/php/_devtools/installer/step_2.php, executing JavaScript in victims' browsers. The Shadowserver Foundation first observed exploitation evidence on 2023-10-20.