CVE-2020-24912

MediumCVSS 6.1

Published: 04/03/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.29%

93th percentile - higher than 93% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.

Risk Assessment

An attacker can hijack the session of an administrator or other logged-in user, gaining full access to the system and data.

Recommendation

Immediately update qcubed to a patched version or apply a workaround by validating and sanitizing the stQuery parameter in profile.php.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.