CVE-2020-24914

CriticalCVSS 9.8

Published: 04/03/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.45%

92th percentile - higher than 92% of all known CVEs

Summary

A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.

Risk Assessment

An unauthenticated attacker can gain full control of the server, steal sensitive data, or deploy malware, leading to complete system compromise.

Recommendation

Immediately update qcubed to a patched version. If unavailable, implement input validation and sanitization before deserialization as a workaround.

Original NVD description (English source)

A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.